Jump to content


Photo

Add/Remove Programs disabled


  • This topic is locked This topic is locked
14 replies to this topic

#1 hhtigerlily

hhtigerlily

    Member

  • Full Member
  • Pip
  • 5 posts

Posted 28 June 2004 - 07:37 AM

Not sure if I've been hijacked or if my problem is caused by a virus or what, but when I go to Start>Settings>Control Panel>Add/Remove Programs, a window opens with nothing in it except for the following:

Change or Remove ProgramsAdd New ProgramsAdd/Remove Windows Components

in that exact order with no spaces between.

Also, there is a button in the bottom right hand corner that reads Cl&ose with the ampersand in it. When I click on it, the window does not close. It does nothing.

I have also been having problems with Internet Explorer - some links with Javascript in the code or that should open in a new window will not open. I click on those links and nothing happens.

Any ideas what might be causing this? Please see my most recent HJT log.

Logfile of HijackThis v1.97.3
Scan saved at 9:11:21 PM, on 28/06/2004
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\crypserv.exe
C:\WINNT\System32\svchost.exe
C:\EPOAgent\naimas32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\HijackThis.exe

O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"Logfile of HijackThis v1.97.3
Scan saved at 9:11:21 PM, on 28/06/2004
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\crypserv.exe
rogram Files\Zone Labs\ZoneAlarm\zlclient.exe"Logfile of HijackThis v1.97.3
Scan saved at 9:11:21 PM, on 28/06/2004
Platform: Windows 2000 SP2 (WinNT 5.00.2195)

C:\WINNT\System32\mspmspsv.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\HijackThis.exe

O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"

#2 Gwyrox732

Gwyrox732

    Gwy|is|here

  • Helper
  • PipPipPipPipPip
  • 514 posts

Posted 28 June 2004 - 09:16 AM

Please update your copy of hijackthis at http://www.spywarein.../HijackThis.exe (and did you have trouble pasting your log file or is THAT what it looks like)?
Quote from Original CWS Article at SWI: "There could be other domains involved in the future." ... We've come a long way since then

Malware esan mala, ji mi disaman. SWI ji kikan ekster!

PM me if you know what that says. Whoever gets it right gets put here!
Bagman wins, good job!

#3 Freebird

Freebird

    Advanced Member

  • Full Member
  • PipPipPip
  • 196 posts

Posted 28 June 2004 - 09:32 AM

hhtigerlily, Hi.
You also need to update your Service Pack from SP2 to SP4 using the Windows Update or directly from Microsoft:
http://www.microsoft...sp4/default.asp

The SP4 update applies to these versions:
Microsoft Windows 2000 Server
Microsoft Windows 2000 Professional
Microsoft Windows 2000 Advanced Server

EDIT
This may resolve the problem as stated in the Microsoft Knowledge base:
http://support.micro...kb;EN-US;292767 Although any problems should have been corrected with SP2, you just might have a corrupted file that needs repairing.
/EDIT

:wave:

Edited by Freebird, 28 June 2004 - 09:40 AM.

We know the speed of light......but, whats the speed of dark? Steven Wright - Scientist and Comedian

#4 hhtigerlily

hhtigerlily

    Member

  • Full Member
  • Pip
  • 5 posts

Posted 02 July 2004 - 09:30 AM

Thanks for the advice - unfortunately however, neither option has rectified the situation. I downloaded the latest HJT and also installed SP4 but to no avail - still cannot add/remove programs and the IE link problem still persists.

Here is the latest HJT log. BTW - It appears I had some trouble pasting the log last time. Sorry - probably should have previewed before posting.

Cheers!

Logfile of HijackThis v1.98.0
Scan saved at 12:20:17 AM, on 3/07/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\crypserv.exe
C:\WINNT\System32\svchost.exe
C:\EPOAgent\naimas32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Documents and Settings\dkenwri\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
F2 - REG:system.ini: UserInit=C:\WINNT\System32\userinit.exe,C:\WINNT\System32\svcpack.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKCU\..\RunServicesOnce: [washindex] C:\Program Files\Washer\washidx.exe

#5 MickeyTheMan

MickeyTheMan

    Member

  • New Member
  • Pip
  • 2 posts

Posted 02 July 2004 - 09:36 AM

Are you using HTA STOP ?
HTASTOP will interfere with the control panel ADD/DELETE programs, at least on the win2k platform.
But since it can be activated/deactivated at the click of a button, it's no real big deal.

#6 Gwyrox732

Gwyrox732

    Gwy|is|here

  • Helper
  • PipPipPipPipPip
  • 514 posts

Posted 02 July 2004 - 11:08 AM

Is that your entire log?
Quote from Original CWS Article at SWI: "There could be other domains involved in the future." ... We've come a long way since then

Malware esan mala, ji mi disaman. SWI ji kikan ekster!

PM me if you know what that says. Whoever gets it right gets put here!
Bagman wins, good job!

#7 Freebird

Freebird

    Advanced Member

  • Full Member
  • PipPipPip
  • 196 posts

Posted 02 July 2004 - 09:11 PM

repeated advice withdrawn

Edited by Freebird, 02 July 2004 - 09:23 PM.

We know the speed of light......but, whats the speed of dark? Steven Wright - Scientist and Comedian

#8 Gwyrox732

Gwyrox732

    Gwy|is|here

  • Helper
  • PipPipPipPipPip
  • 514 posts

Posted 02 July 2004 - 09:17 PM

[edit]Advising the repeated advice which was withdrawl withdrawn :lol:

Edited by Gwyrox732, 02 July 2004 - 09:34 PM.

Quote from Original CWS Article at SWI: "There could be other domains involved in the future." ... We've come a long way since then

Malware esan mala, ji mi disaman. SWI ji kikan ekster!

PM me if you know what that says. Whoever gets it right gets put here!
Bagman wins, good job!

#9 Freebird

Freebird

    Advanced Member

  • Full Member
  • PipPipPip
  • 196 posts

Posted 02 July 2004 - 09:21 PM

Uhhh...he already has the 1.98, Freebird, that was the first hting I told him to do.

I just noticed, therefore my edit. Perhaps it's a 'copy&paste' problem. The log seems very incomplete.

:wave:
We know the speed of light......but, whats the speed of dark? Steven Wright - Scientist and Comedian

#10 hhtigerlily

hhtigerlily

    Member

  • Full Member
  • Pip
  • 5 posts

Posted 05 July 2004 - 08:19 PM

Hi All,
Thanks for the advice. Unfortunately the problem persists. I have downloaded SpyBot, the most recent HJT and also SP4 but none are capable of fixing it.

I do not have HTA Stop.

I did have some problems with copy & paste as well. Probably related to the the Add & Remove Programs problem.

Here is the new HJT log in its entirety. Thanks!

Logfile of HijackThis v1.98.0
Scan saved at 11:11:49 AM, on 6/07/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\crypserv.exe
C:\WINNT\System32\svchost.exe
C:\EPOAgent\naimas32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
D:\Program Files\Spyware-Cop\Spyware-Cop.exe
C:\WINNT\system32\wuauclt.exe
C:\Program Files\Netscape\Netscape 6\netscp6.exe
C:\Documents and Settings\dkenwri\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
F2 - REG:system.ini: UserInit=C:\WINNT\System32\userinit.exe,C:\WINNT\System32\svcpack.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKCU\..\Run: [Spyware-Cop] "D:\Program Files\Spyware-Cop\Spyware-Cop.exe" /s
O4 - HKCU\..\RunServicesOnce: [washindex] C:\Program Files\Washer\washidx.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{30751063-79FA-4071-96AB-0A0F818AE49F}: NameServer = 203.134.64.66 203.134.65.66

#11 Gwyrox732

Gwyrox732

    Gwy|is|here

  • Helper
  • PipPipPipPipPip
  • 514 posts

Posted 05 July 2004 - 09:13 PM

If that's not your entire log, can you please start up hijack this again, scan, and look for a line that says something to the effect of "Control Panel Restrictions Present"? If it is there place a checkmark next to it and press "fix checked". If it is not there, please say so.
Quote from Original CWS Article at SWI: "There could be other domains involved in the future." ... We've come a long way since then

Malware esan mala, ji mi disaman. SWI ji kikan ekster!

PM me if you know what that says. Whoever gets it right gets put here!
Bagman wins, good job!

#12 hhtigerlily

hhtigerlily

    Member

  • Full Member
  • Pip
  • 5 posts

Posted 08 July 2004 - 02:30 AM

Hi,
As indicated in my previous post, the HJT log was complete. Below is today's... no mention of control panel restrictions is evident.
Thanks!

Logfile of HijackThis v1.98.0
Scan saved at 5:29:38 PM, on 8/07/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\crypserv.exe
C:\WINNT\System32\svchost.exe
C:\EPOAgent\naimas32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
D:\Program Files\Spyware-Cop\Spyware-Cop.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Netscape\Netscape 6\netscp6.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINNT\System32\msiexec.exe
C:\Documents and Settings\dkenwri\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
F2 - REG:system.ini: UserInit=C:\WINNT\System32\userinit.exe,C:\WINNT\System32\svcpack.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKCU\..\Run: [Spyware-Cop] "D:\Program Files\Spyware-Cop\Spyware-Cop.exe" /s
O4 - HKCU\..\RunServicesOnce: [washindex] C:\Program Files\Washer\washidx.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{30751063-79FA-4071-96AB-0A0F818AE49F}: NameServer = 203.134.64.66 203.134.65.66

:wtf:

#13 Master Green

Master Green

    Member

  • Full Member
  • Pip
  • 41 posts

Posted 08 July 2004 - 09:14 AM

Hi,
I am not sure this will be the fix you need but I once came across information some where, some place (even though it was to do with Windows 2000) and I do beleive it was related to a very similiar problem, that by going into your control panel, then folder options, and clicking on view, then putting a bullet where it says "show hidden files & folders"...might show the programs you normally would see in the Add/Remove programs. At this point I don't think you have anything to lose by checking it out. It may or may not be the fix and it may or may not a long term fix but until one is provided, maybe you will get in and do what you need in the mean time...Good luck...Keep us posted.

Edited by Master Green, 08 July 2004 - 09:20 AM.


#14 hhtigerlily

hhtigerlily

    Member

  • Full Member
  • Pip
  • 5 posts

Posted 09 July 2004 - 02:16 AM

Hi,
I checked control panels/folder options/ and 'show hidden files etc...' is already checked, but thanks anyway for the tip.

I think the APPWIZ.CPL file might have been corrupted somehow. I can see it's still there so it hasn't been deleted, but it could be damaged. Methinx I might have to reinstall Windows 2000. I had hoped this wouldn't be the case, but I've exhausted just about all other possibilities.

Cheers...

#15 jedi

jedi

    aequam memento rebus in arduis servare mentem

  • Emeritus
  • PipPipPipPipPip
  • 15,830 posts

Posted 22 November 2005 - 07:52 AM

Since the issue appears to be resolved this Topic is closed.

If you need this topic reopened, please request this by sending the moderating team
an email with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic.
jedi

My help is free, but if you wish to help keep these forums running please consider a donation, see This Topic for details.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

Member of ASAP and UNITE
Support SpywareInfo Forum - click the button