Windows ME (need I say more?)

My advice: Dump ME and get XP.

I know, I know. I forgot to mention I'm flat broke. As soon I can afford it, though, I will.

Re: Windows ME (need I say more?)


No. And the ones with the flashiest, most enticing ads, are yuckware-laden.

Now, ME pretty much does suck, but it can be made to run halfway decently. A frequent problem is a too-busy startup folder ... particularly with older (PIII or equivalent and earlier) processors and RAM of 256MB or less. I'm gonna guess you've got a buncha stuff loading with Windows that doesn't need to be there ... have you got a lot of icons down at the lower right corner of your display, next to your clock?

You say " ... it takes forever to load a new page"; how does the machine behave when doing stuff that doesn't involve the internet? Some security/privacy software of newer vintage is a bit too resource intensive for some older machine/operating system combinations, but to my knowlrdge, neither CA nor Spybot S&D should be a problem, though if you're using Spybot S&D's TeaTimer you can experience all sortsa problems - I recommend you turn that off and forget its there. What antivirus are you running? Didn't see any mention of that.

Re: Windows ME (need I say more?)
... have you got a lot of icons down at the lower right corner of your display, next to your clock?
Just the "Mouse Suite" and "Volume", plus the firewall and S&D icons (yeah, I wasn't sure about "Tea Timer"... I downloaded it, but haven't installed it... good to know!).

You say " ... it takes forever to load a new page"; how does the machine behave when doing stuff that doesn't involve the internet?
Fine, mostly. I suspect you're right about the extra programs loading with Windows... A couple times, it has frozen while in Safe Mode. I think it's to do with "Access IBM"(?) that's on my Recovery CD-ROM. I also turned off all the 'scheduled task' and 'auto update' options that I could find... all the Control Panel stuff.

What antivirus are you running? Didn't see any mention of that.
yeah, ummm...... I'm not running any.

GET YOURSELF AN ANTIVIRUS


I'm gonna guess that hang up related to that "IBM Access" thing stems from the "IBM Access" file itself being corrupt. Again just a guess, but I suspect its an overlay on the standard Windows Help/Troubleshooting Wizard that pops up when you enter safe mode - there's prolly a way to disable it, but I haven't looked into it. I s'pose I could ... I'll let you know if I find anything useful.

Tell ya what - create a folder for it either directly on your root drive (the drive on which Windows is installed, usually "Drive C:\") or in your Programs folder, then download HiJackThis into it, extract it, then, with nothing else running and no browsers, email, messaging, or chat clients open, click the icon to run it. A splash screen should come up; select the "Open the Misc Tools section" bar, then place a checkmark in the "List also minor sections (full)" box next to the "Generate StartupList Log" bar, click the bar to generate the log. Don't do anything else with HJT right now, just save the log and post it here. Once You've saved the log, close HJT - WITHOUT DOING ANYTHING ELSE WITH IT

StartupList report, 11/5/2006, 1:30:17 PM
StartupList version: 1.52.2
Started from : C:\HJT\HIJACKTHIS\HIJACKTHIS.EXE
Detected: Windows ME (Win9x 4.90.3000)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
* Showing rarely important sections
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\PROGRAM FILES\CA\SHAREDCOMPONENTS\HIPSENGINE\UMXCFG.EXE
C:\PROGRAM FILES\CA\SHAREDCOMPONENTS\HIPSENGINE\UMXPOL.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\IBMTOOLS\APTEZBTN\APTEZBP.EXE
C:\WINDOWS\SYSTEM\PELMICED.EXE
C:\PROGRAM FILES\CA\CA INTERNET SECURITY SUITE\CCTRAY\CCTRAY.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\CA\CA INTERNET SECURITY SUITE\CA PERSONAL FIREWALL\CAPFAEM.EXE
C:\PROGRAM FILES\CA\SHAREDCOMPONENTS\HIPSENGINE\UMXFWHLP.EXE
C:\PROGRAM FILES\CA\SHAREDCOMPONENTS\HIPSENGINE\UMXAGENT.EXE
C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\TEATIMER.EXE
C:\PROGRAM FILES\CA\CA INTERNET SECURITY SUITE\CA PERSONAL FIREWALL\CAPFSEM.EXE
C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\HJT\HIJACKTHIS\HIJACKTHIS.EXE

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\WINDOWS\Start Menu\Programs\StartUp]
Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

ScanRegistry = C:\WINDOWS\scanregw.exe /autorun
TaskMonitor = C:\WINDOWS\taskmon.exe
PCHealth = C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
SystemTray = SysTray.Exe
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
AEZBProc = c:\ibmtools\aptezbtn\aptezbp.exe
Mouse Suite 98 Daemon = PELMICED.EXE
GDRIVE = C:\IBMTOOLS\IBMBOOT\GDRIVE.EXE -N
ACCIBM = C:\IBMTOOLS\Access IBM\bin\AccLaunch.exe
cctray = "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe"
cafwc = C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe -cl
capfaem = C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfaem.exe
UmxFwHlp = C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
UmxAgent = C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
SchedulingAgent = mstask.exe
SSDPSRV = C:\WINDOWS\SYSTEM\ssdpsrv.exe
*StateMgr = C:\WINDOWS\System\Restore\StateMgr.exe
KB918547 = C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE
KB891711 = C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
UmxFwHlp = C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe /oneshot
UmxCfg = C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
UmxPol = C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

SpybotSD TeaTimer = C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

--------------------------------------------------

File association entry for .TXT:
HKEY_CLASSES_ROOT\txtfile\shell\open\command

(Default) = C:\WINDOWS\NOTEPAD.EXE %1

--------------------------------------------------

Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)

[{89820200-ECBD-11cf-8B85-00AA005B4395}] *
StubPath = regsvr32.exe /s /n /i:U shell32.dll

[>PerUser_MSN_Clean] *
StubPath = C:\WINDOWS\msnmgsr1.exe

[PerUser_LinkBar_URLs] *
StubPath = C:\WINDOWS\COMMAND\sulfnbk.exe /L

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = rundll32.exe advpack.dll,UserInstStubWrapper {44BBA840-CC51-11CF-AAFA-00AA00B6015C}

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = rundll32.exe advpack.dll,UserInstStubWrapper {7790769C-0471-11d2-AF11-00C04FA35D02}

[^RNA] *
StubPath = rundll rnasetup.dll,installoptionalcomponent rna

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = C:\WINDOWS\SYSTEM\ie4uinit.exe

[{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}] *
StubPath = C:\WINDOWS\SYSTEM\updcrl.exe -e -u C:\WINDOWS\SYSTEM\verisignpub1.crl

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=Explorer.exe
SCRNSAVE.EXE=
drivers=mmsystem.dll power.drv

--------------------------------------------------

Checking for EXPLORER.EXE instances:

C:\WINDOWS\Explorer.exe: PRESENT!

C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present
C:\WINDOWS\Fonts\Explorer.exe: not present

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 4/11/2006, 12:10:18)

[rename]
NUL=C:\WINDOWS\TEMP\_iu14D2N.tmp

--------------------------------------------------

C:\AUTOEXEC.BAT listing:

SET windir=C:\WINDOWS
SET winbootdir=C:\WINDOWS
SET COMSPEC=C:\WINDOWS\COMMAND.COM
SET PROMPT=$p$g
SET TEMP=C:\WINDOWS\TEMP
SET TMP=C:\WINDOWS\TEMP
SET PATH=C:\WINDOWS;C:\WINDOWS\COMMAND;C:\WINDOWS;C:\WINDOWS\COMMAND;C:\WINDOWS;C:\WINDOWS\COMMAND;;C:\IBMTOOLS

--------------------------------------------------

Checking for superhidden extensions:

.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL - {53707962-6F74-2D53-2644-206D7942484F}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Tune-up Application Start.job
PCHealth Scheduler for Data Collection.job
Registration reminder 3.job
Scan for Viruses.job

--------------------------------------------------

Enumerating Download Program Files:

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH9.OCX
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[Update Class]
InProcServer32 = C:\WINDOWS\SYSTEM\IUCTL.DLL
CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?39014.7804166667

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

WebCheck: C:\WINDOWS\SYSTEM\WEBCHECK.DLL
UPnPMonitor: C:\WINDOWS\SYSTEM\UPNPUI.DLL
AUHook: C:\WINDOWS\SYSTEM\AUHOOK.DLL

--------------------------------------------------
End of report, 8,253 bytes
Report generated in 0.193 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

Hmmmm ... that doesn't really help me as much as I'd hoped it would - but it does appear you do have TeaTimer running - open Spybot S&D, select "Tools", then select "Resident", and make sure "Resident "TeaTimer (Protection of over-all system settings) active" is UNCHECKED, then close Spybot S&D.


When you've done that, reboot, and once your machine has fully booted, run a normal scan-and-save-log with HJT, a system scan, not a startup scan, and post that log here. Might be a few hours before I get back to you - got some other stuff going on right now.

Thanks for your help, timber.
It looks like I may have failed to disable TeaTimer. (?) I don't see a "Tools" selection in S&D.
On my taskbar icon, I found "Use Resident in IE Sessions", which I unchecked... That made the
icon disappear, but it resurrected itself when I restarted! (Should I delete the TeaTimer application in
the S&D Programs folder?)
Oh, and I still haven't found an AntiVirus, as you can see.
++++++++++++++++++++++++++++++++
Logfile of HijackThis v1.99.1
Scan saved at 4:31:42 PM, on 11/5/2006
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\CA\SHAREDCOMPONENTS\HIPSENGINE\UMXCFG.EXE
C:\PROGRAM FILES\CA\SHAREDCOMPONENTS\HIPSENGINE\UMXPOL.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\IBMTOOLS\APTEZBTN\APTEZBP.EXE
C:\WINDOWS\SYSTEM\PELMICED.EXE
C:\PROGRAM FILES\CA\CA INTERNET SECURITY SUITE\CCTRAY\CCTRAY.EXE
C:\PROGRAM FILES\CA\CA INTERNET SECURITY SUITE\CA PERSONAL FIREWALL\CAPFAEM.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\CA\SHAREDCOMPONENTS\HIPSENGINE\UMXFWHLP.EXE
C:\PROGRAM FILES\CA\SHAREDCOMPONENTS\HIPSENGINE\UMXAGENT.EXE
C:\PROGRAM FILES\CA\CA INTERNET SECURITY SUITE\CA PERSONAL FIREWALL\CAPFSEM.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\HJT\HIJACKTHIS\HIJACKTHIS.EXE

R3 - URLSearchHook: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [AEZBProc] c:\ibmtools\aptezbtn\aptezbp.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] PELMICED.EXE
O4 - HKLM\..\Run: [GDRIVE] C:\IBMTOOLS\IBMBOOT\GDRIVE.EXE -N
O4 - HKLM\..\Run: [ACCIBM] C:\IBMTOOLS\Access IBM\bin\AccLaunch.exe
O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe"
O4 - HKLM\..\Run: [cafwc] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe -cl
O4 - HKLM\..\Run: [capfaem] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfaem.exe
O4 - HKLM\..\Run: [UmxFwHlp] C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
O4 - HKLM\..\Run: [UmxAgent] C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [KB918547] C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKLM\..\RunServices: [UmxFwHlp] C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe /oneshot
O4 - HKLM\..\RunServices: [UmxCfg] C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
O4 - HKLM\..\RunServices: [UmxPol] C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE