Mystery boxes

This one sometimes occurs after running Spybot.

invalid backweb
application id
7288971

Run msconfig and look for an entry for backweb and uncheck it there.

You should always post a StartupList when seeking help with similar such problems:

http://www.lurkhere.com/~nicefiles/

If you don't have the application you can get that, or HijackThis from the site above.

In HijackThis the Startuplist is found under config > miscl tools > generate startuplist.

Hi,

here's the startuplist from hijack

StartupList report, 22/01/2003, 18:05:06
StartupList version: 1.51
Started from : C:\UNZIPPED\HIJACKTHIS191\HIJACKTHIS.EXE
Detected: Windows ME (Win9x 4.90.3000)
Detected: Internet Explorer v5.50 (5.50.4134.0100)
* Using default options
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZONEALARM.EXE
C:\PROGRAM FILES\KODAK\KODAK EASYSHARE SOFTWARE\BIN\EASYSHARE.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKCALREM.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\ZONELABS\MINILOG.EXE
C:\WINDOWS\SLLIGHTS.EXE
C:\PROGRAM FILES\GETRIGHT\GETRIGHT.EXE
C:\PROGRAM FILES\TREND PC-CILLIN 2000\PCCIOMON.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\UNZIPPED\HIJACKTHIS191\HIJACKTHIS.EXE

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\WINDOWS\Start Menu\Programs\StartUp]
UPDATE GROKSTER.LNK = C:\PROGRA~1\GROKSTER\WiseUpdt.exe
Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe

Shell folders Common Startup:
[C:\WINDOWS\All Users\Start Menu\Programs\StartUp]
ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

MSConfigReminder = C:\WINDOWS\SYSTEM\msconfig.exe /reminder

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

(Default) =

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 22/1/2003, 15:56:48)

[Rename]
NUL=C:\WINDOWS\SYSTEM\STDOLE2.TLB
C:\WINDOWS\SYSTEM\STDOLE2.TLB=C:\_RESTORE\EXTRACT\W0162389.CPY
NUL=C:\WINDOWS\SYSTEM\OLEAUT32.DLL
C:\WINDOWS\SYSTEM\OLEAUT32.DLL=C:\_RESTORE\EXTRACT\W0162385.CPY
C:\WINDOWS\powerpnt.ini=C:\_RESTORE\EXTRACT\powerpnt.ini
C:\WINDOWS\wavemix.ini=C:\_RESTORE\EXTRACT\wavemix.ini
C:\WINDOWS\tasks\desktop.ini=C:\_RESTORE\EXTRACT\desktop.ini
C:\WINDOWS\win.ini=C:\_RESTORE\EXTRACT\win.ini
C:\WINDOWS\system.ini=C:\_RESTORE\EXTRACT\system.ini
C:\WINDOWS\USER.DAT=C:\_RESTORE\EXTRACT\USER.DAT
C:\WINDOWS\SYSTEM.DAT=C:\_RESTORE\EXTRACT\SYSTEM.DAT
C:\WINDOWS\CLASSES.DAT=C:\_RESTORE\EXTRACT\CLASSES.DAT

--------------------------------------------------

C:\AUTOEXEC.BAT listing:

SET PATH=C:\PROGRA~1\PANDAS~1\PANDAA~1.0;C:\WINDOWS;C:\WINDOWS\COMMAND
SET windir=C:\WINDOWS
SET winbootdir=C:\WINDOWS
SET COMSPEC=C:\WINDOWS\COMMAND.COM
SET PROMPT=$p$g
SET TEMP=C:\WINDOWS\TEMP
SET TMP=C:\WINDOWS\TEMP

--------------------------------------------------

C:\WINDOWS\WINSTART.BAT listing:

C:\WINDOWS\TMPCPYIS.BAT
DEL C:\PQSC\PROGRAM\*.dll
DEL C:\PQSC\PROGRAM\*.exe
RD C:\PQSC\PROGRAM
RD C:\PQSC
DEL C:\WINDOWS\WINSTART.BAT

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll - {724d43a9-0d85-11d4-9908-00400523e39a}

--------------------------------------------------

Enumerating Task Scheduler jobs:

ScanDisk.job
Tune-up Application Start.job
PCHealth Scheduler for Data Collection.job
Disk Defragmenter.job
1 Copernic Intra-Daily ~Default User.job
2 Copernic Daily ~Default User.job
3 Copernic Weekly ~Default User.job
4 Copernic Monthly ~Default User.job
Video Reminder.job
Create New Job.job
Memory.job
Hard Drive C.job
All E-mail.job
Whole System.job

--------------------------------------------------

Enumerating Download Program Files:

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[YInstStarter Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\YINSTHELPER.DLL
CODEBASE = http://download.yahoo.com/dl/installs/yinst.cab

[plug Class]
InProcServer32 = C:\WINDOWS\DOWNLO~1\CHARGI~1.DLL
CODEBASE = http://dist02.chargitdial.com/chargitplug.dll

[QuickTime Object]
InProcServer32 = C:\WINDOWS\SYSTEM\QTPLUGIN.OCX
CODEBASE = http://www.apple.com/qtactivex/qtplugin.cab

[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\DIRECTOR\SWDIR.DLL
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

[IntraLaunch.MainControl]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\INTRALAUNCH.OCX
CODEBASE = file://D:\IntraLaunch.CAB

[HouseCall Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\XSCAN53.OCX
CODEBASE = http://a840.g.akamai.net/7/840/537/2002112001/housecall.antivirus.com/housecall/xscan53.cab

[CV3 Class]
InProcServer32 = C:\WINDOWS\SYSTEM\WUV3IS.DLL
CODEBASE = http://windowsupdate.microsoft.com/R1108/V31Controls/x86/mil/en/actsetup.cab

[{8522F9B3-38C5-4AA4-AE40-7401F1BBC851}]
CODEBASE = http://2passwords.com/all_FREE_xxx.exe

[AV Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\PAV.DLL
CODEBASE = http://www.pcpitstop.com/antivirus/PCPAV.CAB

[RdxIE Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\IE_GROKSTER.DLL
CODEBASE = http://www.grokster.com/rdx/RdxIE.cab

--------------------------------------------------
End of report, 6,456 bytes
Report generated in 0.129 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

Are there things that need some correction?

thanks.

cubbycuddly

Rog seems to be offline and so I took a look.

Here's what I found:

Go to Start>Programs>Startup and remove these shortcuts:

KODAK Software Updater C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe

UPDATE GROKSTERC:\PROGRA~1\GROKSTER\WiseUpdt.exe

-----------------------------------------------------------

In Downloaded Program Files delete thisunless you want to use Grokster)

C:\WINDOWS\DOWNLOADED PROGRAM FILES\IE_GROKSTER.DLL

Also in Downloaded program files remove this:
chargitplug.dll