updatedlog--hangs on shutdown, freezes, please help

Hello, again. :)

If you are still using Spyware Doctor, please disable it so it does not interfere with our fix.
To disable Spyware Doctor from running on your system startup:
1. First, disable the OnGuard Tools. This way, when you exit Spyware Doctor, these tools won't stay resident in the background.
2. Click the "Settings" button on the left side.
3. Click the "Startup Settings" link.
4. Uncheck "Run at Windows Startup".
5. Click the "Apply" button.
Exit by a right-click on the "Spyware Doctor" icon in the system tray and choose "Exit".
[To enable Spyware Doctor when you are finished, open the program, Settings>Startup Settings> CHECK "Run at Windows Startup">APPLY
Exit. Reboot.]

To disable PCTools Browser Monitor: If you are running Internet Explorer, click Tools > Manage Add-ons. If PCTools Browser Monitor is on the list, click it & select Disable. You will need to restart your browser after making the change.


If you are not using it, and that Spyware Doctor just an old registry entry, please let me know, so we can fix it later.

Please launch HijackThis and plasce a checkmark next to these:


O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O15 - Trusted Zone: http://dl.iwin.com
O15 - Trusted Zone: http://www.iwin.com

If you did not set this restriction, please fix this as well:
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

Close all windows except HijackThis and click "Fix Checked".

Reboot.

Please download Ad-Aware SE Personal and install it. If you already have Ad-Aware SE, please configure it as indicated below. If you have a previous version of Ad-Aware, please uninstall your current version and install the newest version SE 1.06.
1) Run Ad-Aware, and click Check for updates now.
2) Select Configurations (click the Gear wheel at the top) as follows:

• General Button > Safety & Settings: Check (Green) all three.
• Tweak Button > Cleaning Engine > UNcheck "Always try to unload modules before deletion".

Click Proceed.3) To start the scan, Click > "Scan Now" at left

• Deselect "Search for negligible risk entries" as negligible risk entries (MRU's) are not considered to be a threat.
• Select "Search for low-risk threats"
• Select "Perform full system scan"
• Click Next

4) When the scan has completed, select Next.

• In the Scanning Results window, select the "Critical Objects" tab.
• Right-click on the screen and choose "Select all objects"
• In the "Scan Summary" tab, check the box next to each additional "target family" you wish to remove.
• Click Next to remove the objects selected, and click OK to the prompt.
• Restart the computer.

Download and scan with Spybot S&D 1.4.

1. Install Spybot. Be sure to UNCHECK TeaTimer when presented with the option to install.
2. Run Spybot, go to the Menu Bar at the top choose Mode and make certain that " Default mode" has a check mark beside it.
3. Click the button " Search for Updates".
4. If any updates are found, install them by placing a checkmark next to each one and clicking " Download Updates".

If you encounter any error messages while downloading the updates, manually download them from here.

5. Click on " Immunize". When it detects what has or has not been blocked, block all remaining items by clicking the green plus sign next to immunize at the top.
6. Click the button " Check for Problems".
7. When Spybot is complete, it will be showing RED entries, bold BLACK entries and GREEN entries in the window.
8. Make certain there is a check mark beside all of the RED entries ONLY.
9. Choose " Fix Selected Problems" and allow Spybot to fix the RED entries.
10. REBOOT to complete the scan and clear memory.

Note: After Windows loads, Spybot may run again to clean some files that it could not clean during the prior session. Follow the same procedure.

PC-cillin is an anti-virus. It is okay to leave that running.

There is one item that we can fix in HijackThis:
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/17267a9ab97cd5242719/netzip/RdxIE601.cab

Close all windows except HijackThis and click "Fix Checked"

Reboot.

Download and scan with CCleaner:
http://www.ccleaner.com/downloadbuilds.asp
** Select to download the BASIC version.
1. Before first use, select Options > Advanced and UNCHECK
" Only delete files in Windows Temp folder older than 48 hours"
2. Then select the items you wish to clean up.
In the Windows Tab:
• Clean all entries in the "Internet Explorer" section except Cookies (if you want to keep those).
• Clean all the entries in the "Windows Explorer" section.
• Clean all entries in the "System" section.
• Clean all entries in the "Advanced" section.
• Clean any others that you choose.
In the Applications Tab:
• Clean all except cookies (if you want to keep those) in the Firefox/Mozilla section if you use it.
• Clean all in the Opera section if you use it.
• Clean Sun Java in the Internet Section.
• Clean any others that you choose.
3. Click the " Run Cleaner" button.
4. A pop up box will appear advising this process will permanently delete files from your system.
5. Click " OK" and it will scan and clean your system.
6. Click " exit" when done.

REBOOT into Safemode:
Turn on the computer.
Immediately begin tapping the F8 key
Use the arrow keys to highlight Safe Mode and press the Enter key.

While in Safemode, scan with PC-Cillin, and let's see if it finds and cleans that virus it was alerting you of before. (It may have just conflicted with a filename that is in Ad-aware's definitions.)

Please let me know how things are running after that. Thanks.

That's okay as long as you get a prompt and know that the website you are on is reliable if it is asking for cookie acceptance.

If PC-cillin wants to clean or quarantine that file, let it do that. Make sure you are in Safemode when you run the scan. That eliminates the possibility that the file is running (in which case it would refuse to leave). Let me know how you make out. Good luck!

It cannot be cleaned if the file is running. That is why we are using Safemode.
How old is that Win 98 computer? How much RAM do you have? As you probably know, Microsoft does not support Win 98 anymore. The tools and applications that you are running have been updated over the years -- including Internet Explorer with all its patches. All that is taking up space. It is assumed by the developers that most people are using Windows XP. If your root drive is pretty full, that may be why you are having problems.

It's not a matter of knowing how Win98 works, but today's tools use resources, and it sounds like you don't have HD space or RAM to spare. I believe that filename is from BargainBuddy -- something you may have had a while ago.

Before I have you download a yet another removal tool, let's see if we can manually delete that file in Safemode.

After rebooting into Safemode, double-click the My Computer icon on the Windows desktop.
Click the View menu, and then click Options or Folder Options.
Click the View tab.
In the Advanced settings box, under the "Hidden files" folder, select Show all files.
Click Apply, and then click OK.

See if you can browse to this location and delete the file:
C:/Windows/system\ lwr2.dll --file

Reboot.

Go back and rehide files:
Double-click the My Computer icon on the Windows desktop.
Click the View menu, and then click Options or Folder Options.
Click the View tab.
In the Advanced settings box, under the "Hidden files" folder, DE-select Show all files.
Click Apply, and then click OK.

If that doesn't work, we'll have you kill it with a tool.

That sounds like progress. :)

To answer your question, you can scan with Ad-aware and Spybot whenever you want to. They update about once a week, so I scan whenever I update. ** Note, every so often they will have False Positives, so do not delete what they put in quarantine for at least a week. It's always good to read the Virus & Spyware board here to see if anyone else is getting FP's. In most cases that will be followed by another update, but you would need to restore those files and registry entries from quarantine before rescanning.

Here are some prevention tips for when you get a new computer in the future:

Some of these you have already done, and as you know, Microsoft no longer supports Win98, so you will not be getting Win 98 updates.

1. Visit Windows Update:
Make sure that you have all the Critical Updates recommended for your operating system and IE. The first defense against infection is a properly patched OS.
Windows Update: http://v4.windowsupdate.microsoft.com/en/default.asp

2. Adjust your security settings for ActiveX:
Go to Internet Options/Security/Internet, press 'default level', then OK.
Now press "Custom Level."
In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to 'prompt', and 'Initialize and Script ActiveX controls not marked as safe" to 'disable'.

3. Download and install the following free programs:
a. SpywareBlaster:
http://www.javacoolsoftware.com/spywareblaster.html
Tutorial here: http://www.bleepingcomputer.com/forums/tutorial49.html
b. SpywareGuard:
http://www.javacoolsoftware.com/spywareguard.html
Tutorial here: http://www.bleepingcomputer.com/tutorials/tutorial50.html
Periodically check for updates in both programs.

4. Please use a firewall and realtime anti-virus. Keep the anti-virus software and firewall software up to date.
Note: Zone Alarm Firewall (Zone Labs) http://www.zonelabs.com/store/content/company/products/trial_zaFamily/trial_zaFamily.jsp?lid=home_freedownloads
Sunbelt Kerio has a free version: http://www.kerio.com/kpf_download.html

5. You might consider installing Mozilla / Firefox.
http://www.mozilla.org/

6. Install spyware detection and removal programs:
You may also want to consider installing either or both of AdAware (free version) and Spybot S&D (freeware). Use these programs to regularly scan your system for and remove many forms of spyware/malware.

a. Ad-aware: http://www.lavasoft.de/software/adaware/

b. SpyBot S&D: http://safer-networking.org/en/news/2005-05-31.html

I would check for updates in SpyBot once a week or so.
Check for updates in Ad-aware frequently.

If you have recently installed AVG Anti-Spyware, it is a free trial product for 30 days. After that you can purchase it for full features OR you can also keep the free version to use as an on-demand scanner (recommended).
You will still be able to manually update it using the *update* button

7. Before using or purchasing any Spyware/Malware protection/removal program, always check the Rogue/Suspect Spyware List.
Here is the link:
http://www.spywarewarrior.com/rogue_anti-spyware.htm


8. If you have not already done so, you might want to install CCleaner and run it in each user's profile: http://www.ccleaner.com/
** UNcheck the option to install the Yahoo toolbar that is checked by default for the Standard version, or download the toolbar-free versions (Slim or Basic) when given the option for those.

9. If you use Adobe Reader it may need to be updated to be sure that you have a more secure version. If you are using a version prior to v. 6.05, you should update to 6.05, preferably version 8. It would be best to remove prior versions before updating to a new version.
Info here: http://www.adobe.com/support/security/bulletins/apsb06-20.html
If you need additional assistance, the Adobe forums are here: http://www.adobe.com/support/forums/main.html


10. Make sure you are using the most updated version of Java.
The current version is Java Runtime Environment (JRE)1.6.0
You can go here to download the latest version of Java Runtime Environment (JRE) 6.
Scroll down to where it says " The J2SE Runtime Environment (JRE) allows end-users to run Java applications".

Click the link to download the Windows (Offline Installation) package: Save it, do not run it. When the download is complete, close the browser.

Remove all prior versions using Add/Remove Programs, and delete the Java folder in Program Files.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6-windows-i586.exe to install the newest version.
Official JAVA Installation Instructions if needed.
Reboot.

11. Here are some helpful articles:
"So how did I get infected in the first place?"
http://computercops.biz/postlite7736-.html

"I'm not pulling your leg, honest"
by Sandi Hardmeier
http://www.microsoft.com/windows/IE/community/columns/pulling.mspx

Let us know if we have not resolved your problem. Otherwise, you are good to go.
Happy and Safe Surfing!

You are most welcome. I'm glad we could help. :)