HijackThis Log – Internet Connection TOTALLY stalled !!

[tcwc]

HijackThis Log – Internet connection TOTALLY stalled!!!

Please kindly help:
This is an old computer that has Window 98 ….. one day it STOPPED to connect to the internet. All other programs and files are working fine, but just the Internet connection.

The other computers that are connected to the same network/router/modem are working find.

Please kindly advise.
Many Thanks.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:19:40 PM, on 8/3/08
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY ANTI-VIRUS PERSONAL PRO\KAVSVC.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\STARTER.EXE
C:\WINDOWS\SYSTEM\PELMICED.EXE
C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER\DPPS2.EXE
C:\PROGRAM FILES\SUPPORT.COM\BIN\TGCMD.EXE
C:\WINDOWS\DIT.EXE
C:\WINDOWS\SYSTEM\USBMONIT.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY ANTI-VIRUS PERSONAL PRO\KAV.EXE
C:\PROGRAM FILES\MICROSOFT BROADBAND NETWORKING\MSBNTRAY.EXE
C:\WINDOWS\DITEXP.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\MICROSOFT BROADBAND NETWORKING\IPHLPSVR.EXE
C:\PROGRAM FILES\TREND MICRO\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://www.coolwwwsearch.com/z/b/x1.cgi?656387 (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.coolwwwsearch.com/z/b/x1.cgi?656387 (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://www.coolwwwsearch.com/z/b/x1.cgi?656387 (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINDOWS\system32\search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.coolwwwsearch.com/z/b/x1.cgi?656387 (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = C:\WINDOWS\system32\searchbar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.bellsouth.net
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.the-exit.com/search
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.bellsouth.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.payfortraffic.net/search.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.payfortraffic.net/search.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.payfortraffic.net/search.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,(Default) = http://www.martfinder.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.searchv.com/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = http://www.the-exit.com/search
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.searchv.com/search.php?qq=%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://www.coolwwwsearch.com/z/a/x1.cgi?656387 (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.the-exit.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by BellSouth
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http://fau.proxy.fcla.edu:8888
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.mot.com
R3 - URLSearchHook: MailTo Class - {01A9EB7D-69BC-11D2-AB2F-204C4F4F5020} - C:\WINDOWS\SYSTEM\DNSRELAY.DLL
O1 - Hosts: 1123694712 auto.search.msn.com
O1 - Hosts: 64.135.204.60 http://www.0190-dialer.com
O1 - Hosts: 64.135.204.60 mtreexxx.net
O1 - Hosts: 64.135.204.60 http://www.mtreexxx.net
O1 - Hosts: 64.135.204.60 network.nocreditcard.com
O1 - Hosts: 64.135.204.60 http://www.online-dialer.com
O1 - Hosts: 64.135.204.60 http://www.sex-explorer.com
O1 - Hosts: 64.135.204.60 sex-explorer.com
O1 - Hosts: 64.135.204.60 http://www.worldsex.com
O1 - Hosts: 64.135.204.60 http://www.al4a.com
O1 - Hosts: 64.135.204.60 http://www.thumbnail-post.com
O1 - Hosts: 64.135.204.60 http://www.madthumbs.com
O1 - Hosts: 64.135.204.60 http://www.thumbzilla.com
O1 - Hosts: 64.135.204.60 http://www.sexocean
O1 - Hosts: 64.135.204.60 http://www.sublimedirectory
O1 - Hosts: 64.135.204.60 http://www.thehun.com
O1 - Hosts: 64.135.204.60 thehun.net
O1 - Hosts: 64.135.204.60 http://www.thehun.net
O1 - Hosts: 64.135.204.60 http://www.exitforcash.com
O1 - Hosts: 64.135.204.60 exit.xitcash.com
O1 - Hosts: 64.135.204.60 top.darkcollection.com
O1 - Hosts: 64.135.204.60 top.wild-nymphets.com
O1 - Hosts: 64.135.204.60 lol.to
O1 - Hosts: 64.135.204.60 http://www.cybernymphets.com
O1 - Hosts: 64.135.204.60 www21.smutserver.com
O1 - Hosts: 64.135.204.60 www13.smutserver.com
O1 - Hosts: 64.135.204.60 http://www.x-x-x-hosting.com
O1 - Hosts: 64.135.204.60 www22.smutserver.com
O1 - Hosts: 64.135.204.60 www2.smutserver.com
O1 - Hosts: 64.135.204.60 www9.kinghost.com
O1 - Hosts: 64.135.204.60 http://www.amateursgonebad.com
O1 - Hosts: 64.135.204.60 www6.kinghost.com
O1 - Hosts: 64.135.204.60 www8.kinghost.com
O1 - Hosts: 64.135.204.60 www7.kinghost.com
O1 - Hosts: 64.135.204.60 http://www.xfreehosting.com
O1 - Hosts: 64.135.204.60 http://www.kinghost.com
O1 - Hosts: 64.135.204.60 http://www.smuthosts.com
O1 - Hosts: 64.135.204.60 http://www.smutserver.com
O1 - Hosts: 64.135.204.60 http://www.xxxvideohost.com
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRAM FILES\FLASHGET\JCCATCH.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\KEN\READER\ACTIVEX\ACROIEHELPER.OCX (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] PELMICED.EXE
O4 - HKLM\..\Run: [Pop-Up Stopper] "C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER\DPPS2.EXE"
O4 - HKLM\..\Run: [System Service] C:\WINDOWS\SYSTEM\MSREXE.EXE
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe" /server /nosystray
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [Gene USB Monitor] C:\WINDOWS\SYSTEM\USBMonit.exe
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot
O4 - HKLM\..\Run: [MSNSysRestore] C:\WINDOWS\SYSTEM\pc32.exe bg
O4 - HKLM\..\Run: [ICSDCLT] C:\WINDOWS\rundll32.exe C:\WINDOWS\SYSTEM\icsdclt.dll,ICSClient
O4 - HKLM\..\Run: [Welcome] C:\WINDOWS\Welcome.exe /R
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - HKLM\..\RunServices: [kavsvc] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe"
O4 - .DEFAULT Startup: Microsoft Broadband Networking.lnk = C:\Program Files\Microsoft Broadband Networking\MSBNTray.exe (User 'Default user')
O4 - Startup: Microsoft Broadband Networking.lnk = C:\Program Files\Microsoft Broadband Networking\MSBNTray.exe
O8 - Extra context menu item: Download using FlashGet - C:\PROGRAM FILES\FLASHGET\jc_link.htm
O8 - Extra context menu item: Download All by FlashGet - C:\PROGRAM FILES\FLASHGET\jc_all.htm
O8 - Extra context menu item: >>> HENTAI MOVIES <<< - javascript:{document.location='http://www.archivehentai.com/ah/25/getpassword.html';}
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRAM FILES\FLASHGET\FLASHGET.EXE
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRAM FILES\FLASHGET\FLASHGET.EXE
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O14 - IERESET.INF: START_PAGE_URL=http://www.bellsouth.net
O15 - Trusted Zone: *.coolwwwsearch.com
O15 - Trusted Zone: *.msn.com
O16 - DPF: {9F77A997-F0F3-11d1-9195-00C04FC990DC} -
O16 - DPF: {86ecb6a0-400a-11d5-b638-00c04faedb18} -
O19 - User stylesheet: C:\WINDOWS\default.css (file missing)
O19 - User stylesheet: C:\WINDOWS\default.css (file missing) (HKLM)

--
End of file - 9011 bytes

[Katana]

Please note that all instructions given are customised for this computer only, the tools used may cause damage if used on a computer with different infections.

If you think you have similar problems, please post a log in the HJT forum and wait for help.

Hello and welcome to the forums

My name is Katana and I will be helping you to remove any infection(s) that you may have.

Please observe these rules while we work:
1. If you don't know, stop and ask! Don't keep going on.
2. Please reply to this thread. Do not start a new topic.
3. Please continue to respond until I give you the "All Clear"
(Just because you can't see a problem doesn't mean it isn't there)

If you can do those three things, everything should go smoothly

I apologize for the delay in responding, but as you can probably see the forums are quite busy.
Unfortunately there are far more people needing help than there are helpers.

Please Note, your security programs may give warnings for some of the tools I will ask you to use.
Be assured, any links I give are safe

----------------------------------------------------------------------------------------

Restore Host File

Download HostsXpert v4.1 and unzip it to your desktop.

• Double click on HostsXpert.exe to launch the program.
• Click on Restore MS Hosts File to restore your Hosts file to its default condition.
• Click on Make ReadOnly to secure it against further infection. (unless you plan to use another host file)
• Exit the program.

Visit the Website for more information.


Please download SUPERAntiSpyware Home Edition (free)

Install it and double-click the icon on your desktop to run it.
It will ask if you want to update the program definitions. Click Yes.
Under Configuration and Preferences, click the Preferences button.
Click the Scanning Control tab.
Under Scanner Options make sure the following are checked:

• Close browsers before scanning
• Scan for tracking cookies
• Terminate memory threats before quarantining.
• Ignore System Restore/Volume Information on ME and XP
• Please leave the others unchecked.
• Click the Close button to leave the control center screen.

On the main screen, under Scan for Harmful Software, click Scan your computer.
On the left check C:\Fixed Drive.
On the right, under Complete Scan, choose Perform Complete Scan.
Click Next to start the scan. Please be patient while it scans your computer.
After the scan is complete a summary box will appear. Click OK.
Make sure everything in the white box has a check next to it, then click Next.
It will quarantine what it found and if it asks if you want to reboot, click Yes.

To retrieve the removal information - please do the following:

• After reboot, double-click the SUPERAntispyware icon on your desktop.
• Click Preferences . Click the Statistics/Logs tab .
• Under Scanner Logs , double-click SUPERAntiSpyware Scan Log .
• It will open in your default text editor (such as Notepad/Wordpad).
• Please highlight everything , then right-click and choose copy.
• Click close and close again to exit the program.

Paste the Super Antispyware log here.

[tcwc]

Hi Katana,

First of all I have to applogize that I was inpatient enough to delete the Windows 98 using DOS commands, and installed a new Windows XP, prior to seeing your responses. Hoping all issues will be solved with the new XP, but was wrong.

The Pointer on the Explorer is working, but the cursor showing where TEXT can be typed is GONE …. meaning I can not type WORD/TEXT on any web pages (i.e. search, login, etc).

Although, the Internet Explorer is now working (can connect online), but the new XP seems to run very unstable (i.e.: it Reboot itself couple times for no reasons; BROWSEUI.DLL file was corrupted - fixed using Microsoft Windows Support).

I am not sure if the corrupted Win 98 was deleted entirely or the XP just installed over the old Win 98. In control panel-Add/Remove and in the Start Menu-All Programs, its display none of the existing programs that are located in the c: Program Files.

Anyway I did the SUPERAntiSpyware scan and here is the result with the latest HiJackThis Log.

Thanks for helping.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:12:32 AM, on 8/14/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\System32\svchost.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = ??
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Pop-Up Stopper] "C:\Program Files\Panicware\Pop-Up Stopper\dpps2.exe"
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java ??? - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.nl/scanforvirus-en ... nicode.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/download/ ... leId=23100
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - Unknown owner - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe (file missing)

--
End of file - 3694 bytes



SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 08/13/2008 at 11:43 PM

Application Version : 4.15.1000

Core Rules Database Version : 3536
Trace Rules Database Version: 1525

Scan type : Complete Scan
Total Scan Time : 01:02:38

Memory items scanned : 252
Memory threats detected : 0
Registry items scanned : 3215
Registry threats detected : 0
File items scanned : 30231
File threats detected : 19

Adware.Tracking Cookie
C:\Documents and Settings\Ethan C\Cookies\ethan c@atdmt[1].txt
C:\Documents and Settings\Ethan C\Cookies\ethan c@2o7[2].txt
C:\Documents and Settings\Ethan C\Cookies\ethan c@microsoftwindows.112.2o7[1].txt
C:\Documents and Settings\Ethan C\Cookies\ethan c@msnportal.112.2o7[1].txt
C:\Documents and Settings\Ethan C\Cookies\ethan c@overture[1].txt
C:\Documents and Settings\Ethan C\Cookies\ethan c@ads.cartoonnetwork[1].txt
C:\Documents and Settings\Ethan C\Cookies\ethan c@ads.pointroll[1].txt
C:\Documents and Settings\Ethan C\Cookies\ethan c@media.mtvnservices[1].txt
.atdmt.com [ C:\Documents and Settings\Ethan C\Application Data\Mozilla\Firefox\Profiles\i6w275i4.default\cookies.txt ]
.windowsmedia.com [ C:\Documents and Settings\Ethan C\Application Data\Mozilla\Firefox\Profiles\i6w275i4.default\cookies.txt ]
.overture.com [ C:\Documents and Settings\Ethan C\Application Data\Mozilla\Firefox\Profiles\i6w275i4.default\cookies.txt ]
.2o7.net [ C:\Documents and Settings\Ethan C\Application Data\Mozilla\Firefox\Profiles\i6w275i4.default\cookies.txt ]
.2o7.net [ C:\Documents and Settings\Ethan C\Application Data\Mozilla\Firefox\Profiles\i6w275i4.default\cookies.txt ]
.media.mtvnservices.com [ C:\Documents and Settings\Ethan C\Application Data\Mozilla\Firefox\Profiles\i6w275i4.default\cookies.txt ]
.media.mtvnservices.com [ C:\Documents and Settings\Ethan C\Application Data\Mozilla\Firefox\Profiles\i6w275i4.default\cookies.txt ]
.media.mtvnservices.com [ C:\Documents and Settings\Ethan C\Application Data\Mozilla\Firefox\Profiles\i6w275i4.default\cookies.txt ]
media.mtvnservices.com [ C:\Documents and Settings\Ethan C\Application Data\Mozilla\Firefox\Profiles\i6w275i4.default\cookies.txt ]
media.mtvnservices.com [ C:\Documents and Settings\Ethan C\Application Data\Mozilla\Firefox\Profiles\i6w275i4.default\cookies.txt ]
media.mtvnservices.com [ C:\Documents and Settings\Ethan C\Application Data\Mozilla\Firefox\Profiles\i6w275i4.default\cookies.txt ]
.msnportal.112.2o7.net [ C:\Documents and Settings\Ethan C\Application Data\Mozilla\Firefox\Profiles\i6w275i4.default\cookies.txt ]
.ads.pointroll.com [ C:\Documents and Settings\Ethan C\Application Data\Mozilla\Firefox\Profiles\i6w275i4.default\cookies.txt ]
.ads.pointroll.com [ C:\Documents and Settings\Ethan C\Application Data\Mozilla\Firefox\Profiles\i6w275i4.default\cookies.txt ]
.ads.pointroll.com [ C:\Documents and Settings\Ethan C\Application Data\Mozilla\Firefox\Profiles\i6w275i4.default\cookies.txt ]
.ads.pointroll.com [ C:\Documents and Settings\Ethan C\Application Data\Mozilla\Firefox\Profiles\i6w275i4.default\cookies.txt ]
.ads.pointroll.com [ C:\Documents and Settings\Ethan C\Application Data\Mozilla\Firefox\Profiles\i6w275i4.default\cookies.txt ]
.ads.pointroll.com [ C:\Documents and Settings\Ethan C\Application Data\Mozilla\Firefox\Profiles\i6w275i4.default\cookies.txt ]
.ads.pointroll.com [ C:\Documents and Settings\Ethan C\Application Data\Mozilla\Firefox\Profiles\i6w275i4.default\cookies.txt ]
.ads.pointroll.com [ C:\Documents and Settings\Ethan C\Application Data\Mozilla\Firefox\Profiles\i6w275i4.default\cookies.txt ]
C:\Documents and Settings\Suk\Cookies\suk@ad.yieldmanager[1].txt
C:\Documents and Settings\Suk\Cookies\suk@media.adrevolver[1].txt
C:\Documents and Settings\Suk\Cookies\suk@adrevolver[1].txt
C:\Documents and Settings\Suk\Cookies\suk@dynamic.media.adrevolver[2].txt
C:\Documents and Settings\Suk\Cookies\suk@msnportal.112.2o7[1].txt
C:\Documents and Settings\Suk\Cookies\suk@richmedia.yahoo[1].txt
C:\Documents and Settings\Suk\Cookies\suk@specificclick[2].txt
C:\Documents and Settings\Suk\Cookies\suk@questionmarket[2].txt
C:\Documents and Settings\Suk\Cookies\suk@atdmt[2].txt
C:\Documents and Settings\Suk\Cookies\suk@apmebf[1].txt
C:\Documents and Settings\Suk\Cookies\suk@mediaplex[1].txt

[Katana]

Why did you delete Windows 98 before the upgrade ?
Are you sure that the system is able to take XP properly ?

When you insert the XP install disc it would have done all that was needed.
There is nothing showing in that log that would cause problems, and it is unlikely that any malware affecting the 98 install will be active on the XP install.
It sounds like you have a corrupt install now, the only thing I can recommend at this stage is to either try a repair install of the XP, or reformat and start from scratch.

[tcwc]

Thanks.
The system is a P III and exceeded the min requirements for XP.
However, it only have 8GB .... and I believed the new xp was installed in the same partition as the old Win98, so when done.. it only have +/- 2GB left, and was unstable.

I finally reformat the computer, and install the xp from scratch. Its now runs fine.

Thanks for your help. I have no further questions/issues on this topic .
Thanks again Malwareremoval Forum

[Gary R]

This topic is now closed.

If you are the originator of this topic, and you need it re-opened please send an email to 'admin at malwareremoval.com', including a link to this topic.

If you have been helped and wish to donate to help with the costs of this volunteer site, please read Donations For Malware Removal

Please do not contact us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.

Gary R