Windows Start up

[WeeIrishDevil]

I have a Dell Demension pc. It has windows XP. Upon start up there is a screen that pops up that states that the keyboard is not found and you have to press F1 to continue to the next screen where it states that you have to accept 'Profile1.' I'm not sure why it does that but I can't get it to start up normally. It also, at times, seems to start up ok .. see the screen with windows XP and the wee bar at the bottom as it is progressing with start up, but then the screen goes black and won't load windows properly. The pc didn't come with a windows XP start up disk so I can't just install windows again. This pc has never ever, since the first days, loaded correctly. Every time it was sent back there was more problems. This isn't actually my pc, but it is a friends pc who is rather pc illiterate. I know most of what I'm doing on the pc, but even I can't figure this out. Nothing I've tried works. I have AdAware and Spybot that I run frequently .. as well as HiJack this. I try to keep this pc free of all the spam and stuff. I also delete cookies, history and temp folders every time I get off the pc. Now there's another problem were having with something on the start up menu. I have disabled it, but not sure how to remove it. It is called sex.exe. I know it came from a porn site, but none of us use porn and I don't like it constantly coming up upon start up. I have disabled the sex.exe from stating up upon start up, yet it still tries to load the page when the browser is accessed. I have changed that repeatedly and without fail, it always goes to that site. I have tried and tried to remove it .. even went into search all files and folders and deleted everything that came up with sex.exe ... but that still isn't enough. I would appreciate any help that someone might be able to give me, seeing as how I can't find anything online, through google search, on how to get shot of this. Thank you

[Cactus]

Run HiJackThis...
Create a Premanent Folder say in MyDocuments,NOT IN TEMP FOLDER,call it HJT.
This is where HJT will save the Backups.

Now close everything down and run HJT...save the LogFile to the HJT folder
you created.
Open the LogFile with notepad,copy the entire LogFile,then paste here in this post.
Don't have HJT fix anything....wait for the Forums HJT techie to look it over.

Cactus

[WeeIrishDevil]

Logfile of HijackThis v1.97.7
Scan saved at 7:23:18 PM, on 6/22/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Messenger Plus! 2\MsgPlus.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\Lexmark X74-X75\lxbbbmon.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Documents and Settings\Owner\My Documents\PC Related\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://red.clientapps.yahoo.com/customi ... .yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customi ... .yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customi ... .yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\PCHealth\HelpCtr\System\panels\blank.htm
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_3_12_0.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_3_12_0.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKCU\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe" /WinStart
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O16 - DPF: Yahoo! Go Fish - http://download.games.yahoo.com/games/c ... /zt3_x.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shoc ... tor/sw.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.c ... st0401.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.c ... pi_416.dll
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toontown.com/sv1.0.13.6/ttinst.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shoc ... wflash.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-l ... cfscan.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab


That was it ... after having run adaware,spybot, as well as C.W.Shredder .... any help would be appreciated.

[brad]

Turn off System Restore. (Turn it back on after this is repaired and you've rebooted.) Close all other open Windows and have HiJackThis Fix:

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://red.clientapps.yahoo.com/customi ... .yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customi ... .yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customi ... .yahoo.com

Now, empty all your TEMP Folders (WinXp has up to 4 of them) / Temporary Internet Files Folder and then empty your "Recycle Bin" and reboot.

brad

[Geekgirl]

[WeeIrishDevil]

I did what you had stated and turned off system restore .. which is what I do each time I use HJT to fix a problem .. fixed those three and then cleaned out temporary folders . as well as cookies and history while I was at it. I then rebooted and everything seemed ok. I turned the system restore back on once I rebooted. But I'm still having the problems with the loading of windows XP ... I took your suggestions about checking to see if it was plugged in correctly and such .. it does appear to be. I had checked it many many times before. Could it be that the port is bad or loose in some way in the internal parts of the computer. Every time we sent it in, came back with one thing after another kinda messed up. It still wants to load kinda funny and sometimes doesn't even load at all. The sex.exe hasn't been able to be removed either. I've tried everything. I know what you were talking about by the google search .. why I said I found out nothing on how to get shot of it. I saw all that you did, but nothing useful in how to get it off here. I do believe that it might be a dialer ... as I've seen the site that pops up from it .. has a number and a dial up mysteriously was found in the network settings. I disabled sex.exe from start up, cleaned out the link for it, as well as removed that dialer. I can't find sex.exe in the search of all files or folders and such ... doesn't seem to exist on the pc so I'm not sure how to even find it to get shot of it. I've done all I could do for now but would really like to make sure it wasn't on this pc at all. Nothing of the links I've found in searches through google have helped at all. It is still there, even if it is doing nothing, doesn't mean I'm comfortable with it on this pc, so if there is anyone else out there that has any ideas on how to get shot of this .. I'd appreciate any help that you may have. Than the lot of you for helping me thus far... I sincerely do appreciate it. I used to have the links to check the files on HJT to see which ones to delete but this isn't my pc and mine isn't online and I can't seem to find them anymore .. so I might have accidentally deleted those links, so I'm sorry I had to bother ye for help with those log files, but it was sincerely appreciated.

[brad]

Turn off "System Restore".
Backup the Registry first.
Go to Start / Run / regedit / and navigate to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run-.
Delete the Sex.exe startup from there.
If it's disabled in MSCONFIG a lot of programs won't pick it up.
Delete all of the Temp Folders / Temporary Internet Files / and Recycle Bin.
Reboot and turn "System Restore" back on.
brad

[WeeIrishDevil]

Ok ... here's what I did. Since you mentioned the registry editor I did go there .. did exactly as you said only I did not find it there in that area ... but I decided to use the edit function .. find .. common startup ... took me to HKEY_LOCAL_MACHINE/Software/Microsoft/Sharedtools/Msconfig/StartupCommon .... to the right had everything sex.exe for start up .. created it's own folder. I deleted the whole folder there. Seems there is other folders there for start up with everything else that I would want to keep on that list. It seems to have removed it from the start up menu. I've not had any problems after having removed the whole folder, but the registry is backed up just in case. I also took the time to do a wee bit of spring cleaning in there while I was at it. lol Thank you very much Brad and the rest of you for helping me. Muchas Gracias Amigos, Go Raibh Maith Agat