Booting Into ScanDisk Every Boot

[Jim Smith]

Every time I reboot W98 I receive a message reading that the HDD may have bad sectors and ScanDisk is automatically run and displays a detailed map of used/unused/partly used and bad clusters. Every time it runs only the last cluster is deemed bad.

Before this began, I had twice booted and received a Missing System Files (whatever) message. Later the HDD developed a tic, tic, tic just as a clock, but that has gone away.

I've run AVG and HouseCall and had to change my AOL passwords because someone was sending out emails using my account and AOL had shut me down.

What should I look for in the Hijack This log? What do R0, R1, O3, etc. mean?

(The world will not end if this is not solved.)

Logfile of HijackThis v1.96.1
Scan saved at 10:09:43 PM, on 10/21/03
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\GRISOFT\AVG7\AVGAMSVR.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER\DPPS2.EXE
C:\PROGRAM FILES\GRISOFT\AVG7\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG7\AVGEMC.EXE
C:\PROGRAM FILES\FREEMEM STANDARD\FREEMEM.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZONEALARM.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\AMERICA ONLINE 7.0\WAOL.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wnd.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by America Online
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Pop-Up Stopper] "C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER\DPPS2.EXE"
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVG7\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVG7\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_RegCleaner] C:\PROGRA~1\GRISOFT\AVG7\AVGREGCL.EXE /BOOT
O4 - HKLM\..\RunServices: [avgamsvr.exe] C:\PROGRA~1\GRISOFT\AVG7\AVGAMSVR.EXE
O4 - HKCU\..\Run: [FreeMem Pro] "C:\PROGRAM FILES\FREEMEM STANDARD\FREEMEM.EXE" Startup
O4 - Startup: dRAMatic.lnk = ?
O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...747.7850925926
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/7...ll/xscan53.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB

[Murf]

Don't see anything unusual. The ticking noice would really concern me that coupled with the bad sector. It could be signs of Hard Drive failure. I would run the hard drive diagnostic program. But you will need to know the manufacture of the hard drive you have.

A clue might be found in device manager.

Right Click on "My Computer" then to Properties, then to the Device Manager TAB.

Click on the + sign next to Disk Drives, hopefully it will tell you the brand of your hartd drive, then go to their webpage and download and run their diagnostic program. Most common ones are:

Maxtor

Seagate

Western Digital

[Jim Smith]

Thanks Murf,

Last week I bought a hard drive and today it became the boot drive.

I did download Maxtor's diagnostic as you suggested and it confirmed that the drive was dying. It is still installed, now as slave, so I could copy some folders and files. I still get the dire messages but related only to the old drive, so the messages will go away when I disconnect it.

I've had some strange going's on and wondered what malware might be executing.

[Murf]

AdWare is an excellant program. I run it weekly.

You can get it Here