Member Avatar for SebastianMWS

Yesterday I (finally) armed and protected my Win98SE old and battered laptop, following instructions I was given by a good soul on this forum. One of many guarding tools is ZoneAlarm that I left pretty much set to default. Today I started receiving alarms that WUCRTUPD.EXE application is trying to get an Internet access (outbound). Shortly, same warning came for WULOADER.EXE. I denied both for the time being.

It has to do something with recent installation of all available Windows Critical Updates, if I recall correctly, one of updates installed was automatic notification about new Critical Updates. The cause for concern is - I never set any time schedule for this reminders ! There are some pretty nasty things that can use a friendly WUCRTUPD.EXE feature, like W32/Ticton-AW32.Ticton. Internet sources are confusing, some advising to allow this process, others absolutely not, so I rather put my trust to this community. I'm posting just HijackThis log for now, I didn't examine the registers with Regedit yet, but with all this installed protection - Spyware Blaster, ZoneAlarm, WinPatrol, Norton Anti Virus, MVPS Hosts File, Google Toolbar ... shouldn't I be warned if this is a real threat ?

Please advise how to proceed (running Spybot ?), I feel much more comfortable to take care about regular Critital Updates check-ups myself, using some sort of scheduler, instead relying on feature that is prone to be abused by felons.

Logfile of HijackThis v1.99.1
Scan saved at 00:46:46, on 12.06.2006
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\IRMON.EXE
C:\PROGRAM FILES\COMPAQ\PROGRAMMABLE KEYS 95\CPQKL.EXE
C:\PROGRAM FILES\COMPAQ\PROGRAMMABLE KEYS 95\CPQKT.EXE
C:\WINDOWS\SYSTEM\ATICWD32.EXE
C:\WINDOWS\SYSTEM\ATITASK.EXE
C:\WINDOWS\SYSTEM\FPDISP3A.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\ONSPEC\USB DISK\FLASHKSK.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\WINDOWS\SYSTEM\USBMONIT.EXE
C:\PROGRAM FILES\BILLP STUDIOS\WINPATROL\WINPATROL.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\PROGRAM FILES\ADOBE\ACROBAT 4.0\DISTILLR\ACROTRAY.EXE
C:\PCSYNC\QDCTRAY.EXE
C:\PROGRAM FILES\PSION\PSIWIN\PSCONSV.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\NETGEAR\WG511V2\WLANCFG5.EXE
C:\PROGRAM FILES\PSION\PSIWIN\ELOGERR.EXE
C:\PROGRAM FILES\SIOL\ADSL\APP\ENTERNET.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\BOSTJAN\SOFTWARE\HIJACKTHIS\HIJACKTHIS.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Encyclopćdia Britannica, Inc.
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [IrMon] IrMon.exe
O4 - HKLM\..\Run: [Compaq PK Daemon] C:\Program Files\COMPAQ\Programmable Keys 95\CPQKL.EXE
O4 - HKLM\..\Run: [Compaq PK Tray Notification] C:\Program Files\COMPAQ\Programmable Keys 95\cpqkt.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AtiCwd32] Aticwd32.exe
O4 - HKLM\..\Run: [AtiKey] Atitask.exe
O4 - HKLM\..\Run: [FinePrint Dispatcher] C:\WINDOWS\SYSTEM\fpdisp3a.exe
O4 - HKLM\..\Run: [USB Disk] C:\PROGRA~1\ONSPEC\USBDIS~1\FLashKsk.exe
O4 - HKLM\..\Run: [Necutray] LEXAREJ0.EXE
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~3\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [Gene USB Monitor] C:\WINDOWS\SYSTEM\USBMonit.exe
O4 - HKLM\..\Run: [CriticalUpdate] C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\Run: [WinPatrol] C:\PROGRAM FILES\BILLP STUDIOS\WINPATROL\winpatrol.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 4.0\Distillr\AcroTray.exe
O4 - Startup: PC sync Quick Data Copy.lnk = C:\PCSYNC\QDCTRAY.EXE
O4 - Startup: PsiWin 2.3 Connection Server.lnk = C:\Program Files\Psion\PsiWin\Psconsv.exe
O4 - Startup: NETGEAR WG511v2 Wireless Assistant.lnk = C:\Program Files\NETGEAR\WG511v2\wlancfg5.exe
O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmwordtrans.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsimilar.html
O8 - Extra context menu item: Backward Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate Page into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmtrans.html
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotions/spywaredetector/ICSScanner37680.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = ,

  • 2 Contributors
  • 3 Replies
  • 200 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by kylethedarkn

Dani AI

Generated

Short answer: those two programs are the legacy Windows Critical Update Notification components used on Windows 98/98SE, and they often trigger outbound prompts because the notifier runs frequently and actually uses two executables. The notification tool checks for critical updates on a tight schedule (by design) and will ask the firewall for network access each time it runs, which explains the repeated ZoneAlarm alerts. ()

Practical checklist (safe, low-effort steps you can follow):

  1. Verify the two executables actually live in your Windows system folder and that their file properties identify the publisher as Microsoft (if they don’t, treat them as suspicious).
  2. Scan the exact EXE files with a multi‑engine service (upload or check the file hash on VirusTotal) and run a full scan with an up‑to‑date AV on the machine. If you must, copy the files to another PC to upload them.
  3. If scans are clean and the files are genuine, allow them outbound in ZoneAlarm (or keep them blocked and manually check Windows Update). If you dislike the frequent checks, uninstall the “Windows Critical Update Notification” component via Add/Remove Programs—Microsoft documents this behaviour and the uninstall route. (virustotal.com)

About ’s kernel32 suggestion: that was a lucky catch/correction. Never delete kernel32.dll or other System/System32 files — they are core OS libraries and removing them will break Windows. If you see advice to delete a system DLL, do not follow it; instead confirm file path/signature and scan. (webopedia.com)

One final note: Windows 98 support and security updates were discontinued in July 2006, so continuing to use a connected Win98 machine carries real risk. If this laptop stays online, consider isolating it from the Internet or moving to a supported OS. (microsoft.com)

Recommended Answers

All 3 Replies

Member Avatar for kylethedarkn

Allow them both they are both critical for security also i found a couple nasties.
Run HJT and check the following
C:\WINDOWS\SYSTEM\KERNEL32.DLL

Also delete kernel32.dll from the windows system folder by using my computer

now upload the file C:\WINDOWS\scanregw.exe file to Jotti's and tell me the results.

Member Avatar for SebastianMWS

Here are my results:

- I ran HijackThis to check and fix the line..

C:\WINDOWS\SYSTEM\KERNEL32.DLL

..but there was no such thing to check !? Is this OK that I don't see running processes after HijackThis shows the results, only in a saved text log ?

- Tried to delete KERNEL32.dll in SYSTEM folder, but I was not allowed to - "Specified file is being used by Windows"

- Uploaded Scanregw.exe to Jotti's, none of scanners could find anything suspicious , scan results are OK.

- I even looked into Registry with regedit, but found nothing fishy in RunServices.

So what's the story with this kernel32.dll ? Why do you think it's nasty or corrupted ?

Member Avatar for kylethedarkn

Your right. Kernel32.dll is clean
My mistake I confused it with Kernel32.exe which is a key process to the Floodnet Virus.
BTW--are you still having any problems

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.