Minor Win98se boot problem

[Eaglefeather]

Just finished reformating the HD and reinstalling all my programs but have come up with a minor boot problem.

During boot, 2 program group windows open. One has just a single Icon for a small Thesaurus program and the other has the icons for the the disabled start-up programs. (The disabled programs are mostly MS Office 2000. I turned them off in msconfig.)

Any ideas on how I go about stopping these two windows from opening during boot? All help greatly appreciated.

I know I should upgrade to a new OS, but I am old and I like old things. Translation: I am a crotchity old man, set in his ways and hate change.

[glc]

Look in your start menu, Startup group. Those don't show in msconfig.

[Eaglefeather]

Thanks GLC. It is amazing, after all the years that I have been fooling around with this confounded contraption I never did realize that items in the Startup Group actually opened on boot. Ah....duh! Must have left my brains back in time somewhere.

Well I removed the "disabled startup items" folder from the Startup group and that windows is no longer opening on boot. However, (why must there always be a, "however?"), the window for the Theasurus is still opening during boot. It was not in the Startup group. I have had this program for at least 5 years and it never did this before. Seeing as it was not shown in the Startup group is there another startup control where it might be found and disabled from starting on boot?

[glc]

Run Sysedit - check system.ini and win.ini - if it's an old Win 3.1 program it will be in there, probably on a run= line.

[Eaglefeather]

Again, thanks for you time GLC, much appreciated.

I checked system.ini and win.ini plus all of the other pop up windows in sysedit and there is no mention of this window (the window title is "Programs") or the program itself anywhere.

Should have mentioned before that I have also checked regedit/local machine/software/microsoft/windows/current version/run but it is not there either. Also checked all of the other run entries as well, such as runonce, etc.

[glc]

Programs? Care to post a HijackThis log after a fresh reboot?

[Eaglefeather]

I goofed during installation and typed in, "C:/Programs" instead of "C:/Program files, when the installer asked where to install the program.

Sorry but I do not understand the second part of your reply, Quote: "Care to post a HijackThis log after a fresh reboot?" Unquote.

[rjfvillarosa]

GLC is refering to this.
http://forum.pcmech.com/showthread.php?t=103171
This program produces a notepad output of everything running on your machine, have a read of the thread, carry out the neccessay prerequisites and then post the results for us to have a look at.

[glc]

I'm wondering if the goof put the folder on the desktop? What I do for old programs like this is create a folder first to direct the install to - and of course, don't make the folder on the desktop.

[Eaglefeather]

First, I checked the desktop and it is not there. Most programs that I have ever installed usually have C:/Program Files as the default location for installs. This particualr program does not use the default and asks you where to install. As I said earlier I goofed and used C:/ Programs by mistake.

Second, I have read and saved all of the information from thread 103171 and also from 104450. I will downloading the needed programs and reading all of the information at the information links.

Just one small question, step 1 of the instructions given at the head of thread 104450 says to download Adaware and perform a number of steps. Step 2 says to download and use spybot.

I have been using spybot for a number of years so already have it. I would just like to clarify these steps, does it mean that I should be using both of these programs? or does it mean to use one or the other?

It will probably take me a day or two to read and absorb all the information given and to download and install the various programs. Once I have all of that done I will run Hyjack This and post the log in the Security forum using Notepad as requested.

[glc]

The instructions are geared toward getting rid of malware. I simply suggested HJT as an easy way to analyze what's running in your startup, someone here will probably be able to recognize what's causing your issue. In your case, just run it after a reboot and post the log in this thread.

We recommend both Ad-Aware and Spybot as they complement each other - each program finds stuff that the other doesn't, and vice versa - and of course the instructions suggest virus scans because the reason in the first place for posting in the Security forum are to take care of malware issues.

[Eaglefeather]

Thanks glc. I have already downloaded HJT and Adaware and have run both spybot and Adaware. Spybot found a few tracking cookies as it usually does and fixed them. Adaaware did not find anything.

I have run HJT after a fresh reboot as requested and the following is the log file it generated.

Logfile of HijackThis v1.99.0
Scan saved at 12:49:52 PM, on 1/17/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\PWRCHUTE\UPS.EXE
C:\PROGRAM FILES\COMMON FILES\EPSON\EBAPI\SAGENT2.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\STARTER.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\WINDOWS\STARTUPMONITOR.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\HOOK99\HOOK99.EXE
C:\DOWNLOADS\UTILITIES\SECURITY\HYJACK THIS\HIJACKTHIS.EXE

O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_5_7_0.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_5_7_0.DLL
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Run StartupMonitor] StartupMonitor.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\RunServices: [UPS] C:\Program Files\Pwrchute\ups.exe
O4 - HKLM\..\RunServices: [SAgent2ExePath] C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunServices: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\RunServices: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\SYSTEM\E_SRCV02.EXE
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: Hook99startup.lnk = C:\Program Files\Hook99\hk2re.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0521.DLL
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0521.DLL
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/112a6279...p/RdxIE601.cab

[glc]

Nothing in that log looks like it would do that - sorry!

[Eaglefeather]

Ok! Well thanks for trying glc, guess I will just have to live with it until the next time I have to reformat the hd. But all is not lost, I learned a whole wack of new things and got some great tools along the way.