Systray overload nightmare

[BargainBin]

Here are my conditions and symptoms:

Shuttle AI61 MB
Athlon 700 Mhz CPU
224 MB RAM
13 Gig HD
Fresh Win98SE install (2 weeks ago)
Run mostly games BF1942 and AVP2
A little bit of surfing, not much else

Last 3 days, sloww-i-i-ing performance. No virus (PC-cillin 2000), Spybot finds little or nothing. Takes for-r-e-e-ever to reboot.

Noticed System Tray has mounted 104 items. That can't be good. iexplore keeps doing illegal operations. have a feeling the Registry may be corrupted?

What do you guys think? Regcleaner? Oh, yes, Spybot hangs up forever on something that looks like 'WWWcoolsearch'.

[BipolarBill]

Systray loading more than once is a sure sign of trouble. Run these:

http://www.sunbelt-software.com/CounterSpy.cfm

http://www.free-av.com/

If they come up clean, you should format and start over.

[BargainBin]

It appears my problems have to do with trojan horses.

I've d/l'ed Antivir, but haven't got to CounterSpy yet.

Antivir found over 75 .EXE's in C:/WINDOWS and //SYSTEM folders from Trojan horse TR/Agent.EM. It removed them all, they looked like files that had popped up in System Tray. Then it found 2789 DLL files related to Trojan horse TR/Dldr.Agen.pe.DLL. It removed them all.

Now I am down to half a dozen items in Systray on reboot. Still takes 3:10 to start up, a week ago it was taking between 0:45 and 0:50 sec to boot up with all the same stuff loaded. I'm probably going to end up reformatting, but I'll try Counter Spy and repost in a few hours.

Got some other things to do now.

Thanks, Bill

[BipolarBill]

So much for PC-Cillin, eh?

Keep at it with AntiVir. Follow up with Counterspy. That should do it.

[MJCfromCT]

Here's my take on the whole PC cleaning thing:

http://users.wpi.edu/~mattc/cgi-bin/...num=1103325110

[BipolarBill]

Kool guide, MJC. You should add Counterspy and AntiVir. Counterspy is a refined version of MS AS and AntiVir finds a lot of spyware as well as nasties.

[BargainBin]

Thanks for all the help. Here's my status:

Ran Counterspy, not bad.
Ran CWShredder, was clean.

Went through sequence with Safe Mode shown in guide.

On W98SE, when go to Start > Run > sysconfig
shows tabs from General...to...Startup

When I check tab under Startup it has 105 items. It seems like too many. Can't get rid of them. I suspect this is why 3:10 reboot time.

Any ideas?

[mrrobotto]

Might give this program a try to remove the startup's you want removed. http://www.majorgeeks.com/download4572.html

[Ol'Tunzafun]

Use Autoruns or even Hijack This, instead of MSCONFIG for cleanup.

Rather than posting your HJT logs here, there are a couple of good databases that will process the log file for you.

Autoruns
http://www.sysinternals.com/ntw2k/fr...autoruns.shtml


Download HijackThis v1.99.01 from here:

http://tools.radiosplace.com/HijackThis.exe

Run it, save the log file and post it to this site:
http://www.hijackthis.de/index.php?langselect=english

Hit "Analyze" and when done,"Save Analyze" (at the bottom of the page).

You'll find another HJT parser here:
http://hjt.iamnotageek.com/

[MJCfromCT]

Originally posted by BipolarBill
Kool guide, MJC. You should add Counterspy and AntiVir. Counterspy is a refined version of MS AS and AntiVir finds a lot of spyware as well as nasties.

Hi Bill, thanks for the compliment, and sorry about the long wait for a reply. I'll certainly be wanting to check out Counterspy, as if someone like you recommends it, it must be a quality product. I've used AntiVir in the past as well, again, a good product, and I'll try and work it into a future update of that guide.

[G]

If you have all of a sudden had problems such as these then I would suggest that you rethink your AV and malware approach.

Nothing beats CounterSpy (pay for this version of the M$ one), it will harden your system too against known registry vulnerabilities (or where known attackers tend to reside).

Now you need a decent AV prog. If Bill says that his free AV solution is a strong one then I would take that as fact.

Both these programs need to be updated and configured correctly. Windows needs to be updated and careful surfing practises should be adhered too. If not you will end up in all sorts of trouble.

The bad guys are out to cause as much trouble and financial loss as possible nowadays, don’t make it easy for them.

[BipolarBill]

Another wonderful little free program is WinPatrol:

http://www.winpatrol.com/

It monitors changes in Windows and intercepts them for your approval just like Counterspy and MS Antispyware. It also allows you to disable or remove startup items much like MSCONFIG - except better and with better descriptions.

Highly recommended.

[tangent]

that is alot of stuff. A good spyware program is a good idea