PCTech Forums

Logfile of HijackThis v1.97.7
Scan saved at 11:47:19 PM, on 5/21/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v5.50 (5.50.4134.0100)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\COMMON FILES\WINTOOLS\WSUP.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMKEYBD.EXE
C:\PROGRAM FILES\ADAPTEC\DIRECTCD\DIRECTCD.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\KEYBDMGR.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\RunDLL.exe
C:\PROGRAM FILES\NETROPA\ONSCREEN DISPLAY\OSD.EXE
C:\PROGRAM FILES\FINEPIXVIEWER\QUICKDCF.EXE
C:\WINDOWS\SYSTEM\LEXPPS.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMUSBKB2.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\COMMON FILES\WINTOOLS\WTOOLSA.EXE
C:\WINDOWS\TEMP\TD_0001.DIR\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch.com/ie.aspx?tb_id=50083
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://hp.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hp.my.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://hp.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://hp.my.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://hp.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50083
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50083
R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WINTOOLS\WTOOLSB.DLL
F1 - win.ini: run=hpfsched
O1 - Hosts: 66.118.163.109 auto.search.msn.com
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_16_0.DLL
O2 - BHO: (no name) - {4B5F2E08-6F39-479a-B547-B2026E4C7EDF} - C:\Program Files\EarthLink TotalAccess\PnEL.dll (file missing)
O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WINTOOLS\WTOOLSB.DLL
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_16_0.DLL
O3 - Toolbar: Pop-Up Blocker - {D7F30B62-8269-41AF-9539-B2697FA7D77E} - C:\Program Files\EarthLink TotalAccess\PnEL.dll (file missing)
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file)
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [Keyboard Manager] C:\Program Files\Netropa\One-touch Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [HPScanPatch] C:\WINDOWS\SYSTEM\HPScanFix.exe
O4 - HKLM\..\Run: [Adaptec DirectCD] C:\PROGRA~1\ADAPTEC\DIRECTCD\DIRECTCD.EXE
O4 - HKLM\..\Run: [LexStart] lexstart.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
O4 - HKLM\..\Run: [WinTools] C:\Program Files\Common files\WinTools\WToolsA.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [WinTools] C:\Program Files\Common files\WinTools\WToolsA.exe
O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - HKCU\..\Run: [E6TaskPanel] "C:\PROGRAM FILES\EARTHLINK TOTALACCESS\TASKPANL.EXE" -winstart
O4 - Startup: Event Reminder.lnk = C:\Program Files\Mindscape\PrintMaster\PMREMIND.EXE
O4 - Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
O4 - Startup: ZMatrix.lnk = C:\Program Files\ZMatrix\matrix.exe
O4 - Startup: Resume Windows Update Installation.lnk = C:\WINDOWS\Windows Update Setup Files\ie6setup.exe
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
O14 - IERESET.INF: START_PAGE_URL=http://hp.my.yahoo.com
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shoc ... wflash.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/C ... 7284490741
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.c ... st0401.cab
O16 - DPF: ConferenceRoom Java Client - http://pix.sexyads.net:8080/java/cr.cab


I can't beleive I did that all by myself... Thanks Ranger Bob! Thanks Brad ! Hope y'all can help ! Quindi

Which O.S. are you using and what is exactly the problem your getting?

Here is some info on Kernel 32.DLL errors:



The Kernel32.dll file handles memory management, input/output operations, and interrupts. When you start Windows, Kernel32.dll is loaded into a protected memory space so that other programs do not take over that memory space.

On occasion, you may receive an invalid page fault (IPF) error message. This error message occurs when a program tries to access the Kernel32.dll protected memory space. Occasionally, the error message is caused by one particular program, and other times the error message is provoked by multiple files and programs.

If the problem results from running one program, the program needs to be replaced. If the problem occurs when you access multiple files and programs, the damage is likely caused by damaged hardware.

You may want to clean boot the computer to help you identify the particular third-party memory-resident software. Note that programs that are not memory-resident can also cause IPF error messages.

The following conditions can cause Kernel32.dll error messages:

Damaged swap file
File allocation damage
Damaged password list
Damaged or incorrect version of the Kernel32.dll file
Damaged registry
Hardware, hot CPU, over clocking, broken power supply, RF noise, ground bounce, or bad hard disk controller
BIOS settings for Wait states, RAM timing, or other BIOS settings
Third-party software that is damaged or incorrectly installed
.dll files that are saved to the desktop
Non-existent or broken Temp folder
A control panel (.cpl) file is damaged
Incorrect or damaged hardware driver
Incorrectly installed printer drivers or HP Jetadmin drivers
Damaged Java Machine
Damaged .log files
Damaged entries in the History folder
Incompatible or damaged dynamic link library files
Viruses
Damaged or incorrect Msinfo32.exe file
Low disk space
More on the possible causes:

Bad memory modules:

Insert the command DEVICE=C:\WINDOWS\HIMEM.SYS /TESTMEM:ON into your Config.sys file. You can use the System Configuration Utility (Select Start > Run and type msconfig in the Open box and press OK, select the Config.sys tab and add the HIMEM.SYS line by pressing the New button). Windows will tell you to reboot your computer, watch your screen for a message; "HIMEM has detected unreliable memory at address xx:xxxxxx" which will certainly indicate that there's a memory problem.
NOTE: It may take many reboots of a few days for this message to appear.

CPU, bus speed or multiplier overclocking.

Graphic acceleration set too high:

Select Control Panel > System, then select the Performance tab, click the Graphics button. Turn down Hardware acceleration by moving the slider a notch to the left, reboot, try again.

Bad or outdated drivers, especially video drivers:

Check with your card manufacturer for an updated set of drivers. Video drivers are updated constantly, it pays to have the latest release, specially if you find yourself having problems with Internet Explorer.

When you use Microsoft Internet Explorer version 3.0, 4.0 under Windows 95 to access the Internet, you may receive the following error message:

EXPLORE caused an invalid page fault in module Kernel32.dll

This problem can be caused by any of the following situations:

One or more dynamic link libraries (DLLs) are located on the desktop.

Internet Explorer's internal Java Just-In-Time (JIT) compiler is enabled, and the Web page you are loading contains a Java program that is incompatible with the compiler.

Internet Explorer is configured to automatically use items that show active content, and the Web page you are loading contains active content that is not functioning properly.

The third-party display driver you are using is damaged or incompatible with Windows 95.

You are using Active Server Pages (ASP) to perform an ODBC query on a database on an Internet Information Server (IIS), or you are running a large ASP file while Secured Sockets Layer (SSL) security is enabled.

To work around this problem, use the appropriate method:

Configure Windows 95 so that DLLs are not hidden, and then rename or move any DLLs located on the desktop. To configure Windows 95 so that DLLs are not hidden, follow these steps:

1. Double-click My Computer.

2. On the View menu, click Options, and then click the View tab.

3. Click to select Show All Files, and then click OK.

To rename a file on the desktop, use the right mouse button to click the file, click Rename on the menu that appears, type the new name for the file, and then press ENTER. To move a file on the desktop, drag the file from the desktop to a folder on your hard disk in My Computer or Windows Explorer. •Disable Internet Explorer's internal Java JIT compiler. To do so, click Options on the View menu in Internet Explorer, click the Advanced tab, and then click the Enable Java JIT Compiler check box in the Active Content area to clear it.

He is having problems with Wtoolsa. I did a Google search for this problem and saw that it looked like a HijackThis scan would be required to clear his problem so I suggested he post his log for brad and others to review since I am not very good at reviewing HijackThis logs. I believe the below line is part of the problem but it may not be the complete fix that is required:

C:\PROGRAM FILES\COMMON FILES\WINTOOLS\WSUP.EXE

I believe in addition to removing this line some folders may also need to be removed.

When you're done with this fix I strongly recommend you update Windows from the Window Update site.

Press Ctrl/Alt/Del and "End Task" or "End Process" on each of the following: (They may or may not be there)
WToolsA.exe

Go to Control Panel / Add/Remove Programs and remove the following if they are there:
WinTools

Turn off System Restore. (Turn it back on after this is repaired and you've rebooted.) Close all other open Windows and have HiJackThis Fix:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch.com/ie.aspx?tb_id=50083
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50083
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50083
R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WINTOOLS\WTOOLSB.DLL
F1 - win.ini: run=hpfsched
O1 - Hosts: 66.118.163.109 auto.search.msn.com
O2 - BHO: (no name) - {4B5F2E08-6F39-479a-B547-B2026E4C7EDF} - C:\Program Files\EarthLink TotalAccess\PnEL.dll (file missing)
O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WINTOOLS\WTOOLSB.DLL
O3 - Toolbar: Pop-Up Blocker - {D7F30B62-8269-41AF-9539-B2697FA7D77E} - C:\Program Files\EarthLink TotalAccess\PnEL.dll (file missing)
O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file)
O4 - HKLM\..\Run: [WinTools] C:\Program Files\Common files\WinTools\WToolsA.exe
O4 - HKLM\..\RunServices: [WinTools] C:\Program Files\Common files\WinTools\WToolsA.exe
O16 - DPF: ConferenceRoom Java Client - http://pix.sexyads.net:8080/java/cr.cab

Now delete these Folders or Files (You may need enable "Show all Files" and disable "Hide System Files" in Windows Explorer / Tools / Folder Options / View Tab) that are Highlighted then empty your "Recycle Bin" and reboot: (You may have to boot to "Safe Mode" in order to delete some Files/Folders)
C:\PROGRAM FILES\COMMON FILES\WINTOOLS

brad

If your not sure how to disable System Restore read this: