dde server window

[ier45]

i have a problem with windows 98 se every time i try to shut down the pc there is a error that says if you want to end task or wait.
i have a software called hijackthis this is the information it has:
Logfile of HijackThis v1.98.2
Scan saved at 1:47:14 PM, on 12/14/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MDM.EXE
D:\PROGRAM FILES\EXECUTIVE SOFTWARE\DISKEEPER\DKSERVICE.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\AHEAD\INCD\INCD.EXE
C:\WINDOWS\SYSTEM\PELMICED.EXE
C:\WINDOWS\TEMP\HPMON.EXE
C:\WINDOWS\SYSTEM\CTFMON.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\NETZERO\EXEC.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\NETZERO\EXEC.EXE
C:\PROGRAM FILES\STEGANOS SECURITY SUITE 6\SSS.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
E:\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =

http://my.netzero.net/s/search?r=minisearch

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =

http://my.netzero.net/s/search?r=minisearch

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

http://my.netzero.net/s/search?r=minisearch

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =

http://www.earthlink.net/search/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

http://my.netzero.net/s/search?r=minisearch

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

http://crackspider.net/ie/assist.php

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

http://my.netzero.net/s/search?r=minisearch

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =

http://my.netzero.net/s/search?r=minisearch

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: URLSearchHook Class - {37D2CDBF-2AF4-44AA-8113-BD0D2DA3C2B8} - C:\PROGRAM FILES\NZSEARCH\SEARCHENH1.DLL
N1 - Netscape 4: user_pref("browser.startup.homepage", "

http://www.aol.com");

(C:\Program Files\Netscape\Users\ba12b\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)
O2 - BHO: MyWay Search Assistant BHO - {04079851-5845-4dea-848C-3ECD647AA554} - (no file)
O2 - BHO: QuickSearch Search Bar - {82315A18-6CFB-44a7-BDFD-90E36537C252} - C:\Program Files\QuickSearch\QuickSearchBar1_27.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - (no file)
O3 - Toolbar: ZeroBar - {F5735C15-1FB2-41FE-BA12-242757E69DDE} - C:\PROGRAM FILES\NETZERO\TOOLBAR.DLL
O3 - Toolbar: ZeroBar - {F0F8ECBE-D460-4B34-B007-56A92E8F84A7} - C:\PROGRAM FILES\NETZERO\TOOLBAR.DLL
O3 - Toolbar: QuickSearch Search Bar - {82315A18-6CFB-44a7-BDFD-90E36537C252} - C:\Program Files\QuickSearch\QuickSearchBar1_27.dll
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [InCD] C:\Program Files\ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] PELMICED.EXE
O4 - HKLM\..\Run: [HPMonitorBootKey] C:\WINDOWS\TEMP\HPMON.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [Machine Debug Manager] C:\WINDOWS\SYSTEM\MDM.EXE
O4 - HKLM\..\RunServices: [DkService] D:\Program Files\Executive Software\Diskeeper\DkService.exe
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [delmsbb] C:\WINDOWS\delmsbb.exe
O4 - HKCU\..\Run: [spc_w] "C:\Program Files\NZSearch\nzspc.exe" -w
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Startup: PowerReg SchedulerV2.exe
O4 - Startup: PowerReg Scheduler.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Search cracks at CrackSpider.NET - {10954C80-4F0F-11d3-B17C-00C0DFE39736} -

http://crackspider.net/ie/btn.php

(file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Search cracks at CrackSpider.NET - {10954C80-4F0F-11d3-B17C-00C0DFE39736} -

http://crackspider.net/ie/btn.php

(file missing) (HKCU)
O12 - Plugin for .mid: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin2.dll
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .mov: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O16 - DPF: {9A95FE4A-0CD3-4698-A0F4-D2264C6E7046} (HPActiveChat Class) -

http://ispe.sdc.hp.com/awebui/jsp/answerweb/applets/ISPEActiveChat.CAB

 

[ZBilau]

hey guy,

your computer is "bombed"!!!!
I suspect it have many many many spywares and virus!!!
try to use spy removals, like adAware(

http://www.lavasoftusa.com/software/adaware/)

and search for virus with a good anti virus.

good luck

 

[TekTippy4U]

i don't like these - but it's up to you to decide to delete "fix" or not...
------------
C:\WINDOWS\SYSTEM\MDM.EXE
(this is Windows Machine Debugger, and while legit, is there any reason for it to be loading at startup and running all the time?
O4 - HKLM\..\RunServices: [Machine Debug Manager] C:\WINDOWS\SYSTEM\MDM.EXE
---------------
kill;
O2 - BHO: MyWay Search Assistant BHO - {04079851-5845-4dea-848C-3ECD647AA554} - (no file)
O2 - BHO: QuickSearch Search Bar - {82315A18-6CFB-44a7-BDFD-90E36537C252} - C:\Program Files\QuickSearch\QuickSearchBar1_27.dll
O3 - Toolbar: QuickSearch Search Bar - {82315A18-6CFB-44a7-BDFD-90E36537C252} - C:\Program Files\QuickSearch\QuickSearchBar1_27.dll
---------------
---------------
this is XP related only I think or much worse - kill it dead;
C:\WINDOWS\SYSTEM\CTFMON.EXE
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
(see

http://www.answersthatwork.com/Tasklist_pages/tasklist_c.htm

[CTFMon comes with Microsoft Office XP and Windows XP – it activates the Alternative User Input Text Input Processor (TIP) and the Microsoft Office XP Language Bar. As long as the Text Services & Speech are enabled in the Control Panel, this program will force itself back into your list of background programs.

Recommendation :
Disable “Text Services & Speech” in the Control Panel if you are not using them. Then, disable CTFMon using Startup Manager. (Note that if you use Word, Excel or PowerPoint to write in different languages, eg. English and Arabic, then you will be using “Text Services & Speech” facilities).]

---------------
This must be a REAL NASTY
O4 - HKCU\..\Run: [delmsbb] C:\WINDOWS\delmsbb.exe

have HijackThis Fix it in Safe Mode and then find any leftovers , files/folders, in question and delete them from DOS, like the QuickSearch Bar stff
------------------
-----------------
these?, I dunno
O4 - Startup: PowerReg SchedulerV2.exe
O4 - Startup: PowerReg Scheduler.exe
----------------
---------------
Kill these;
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Search cracks at CrackSpider.NET - {10954C80-4F0F-11d3-B17C-00C0DFE39736} -

http://crackspider.net/ie/btn.php

(file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Search cracks at CrackSpider.NET - {10954C80-4F0F-11d3-B17C-00C0DFE39736} -

http://crackspider.net/ie/btn.php

(file missing) (HKCU
----------------
-----------
maybe this too;
O16 - DPF: {9A95FE4A-0CD3-4698-A0F4-D2264C6E7046} (HPActiveChat Class) -

http://ispe.sdc.hp.com/awebui/jsp/answerweb/applets/ISPEActiveChat.CAB

----------

Download and install and use Free ZoneAlarm ver

http://www.lavasoftusa.com

- nothing should need being a "Web Server", unless you know what you're doing it for and also look into the DiskKeeper service, and see if it's interfering (running on a schedule and/or all the time on)

Use SpyBot and AdAware as well

TT4U

Notification:
These are just my thoughts....and should be carefully measured against other opinions.
Backup All Important Data/Docs

 

[ier45]

thanks for the info guys but i solve my problem it was the program that was running out of the temp folder but i am still going to use your tips that u submitted

 

[TekTippy4U]

you mean;
C:\WINDOWS\TEMP\HPMON.EXE
that's an old legitimate MS file, as far as I can tell - orig for NT 3.51, still available from M$'s FTP server - whatcha doing with NT and XP files on a 98 box? - a munged upgrade??

but good for finding it anyway - and you can always try Task Manager (ctrl+alt+del) and select funky item and 'End task' - and use MSCONFIG > startup tab (for many/most startup items) - and also boot in safe mode when end task doesn't help to find file in question to delete. Process Explorer (free) from

http://www.sysinternals.com

will help finding what's related to what - and these faqs will help too FAQ760-3962 and FAQ605-4650

TT4U

Notification:
These are just my thoughts....and should be carefully measured against other opinions.
Backup All Important Data/Docs