# I have major problems here



## Sitka (May 2, 2001)

We have 2 computers here. And my husbands computer was working fine this morning and then something happened. He had to reboot and when the computer came back up this is what is on the screen now...

E47150:Incorrect MPEG data format

We can NOT get windows to open at all. I can't get any programs, start up, NOTHING...... it is stuck right there. When I click OK on that it goes away but nothing happens. The computer will not do anything at that point. I've tried opening in safe mode and nothing... the same thing happens. I tried loading the HP recovery CD and can't get it to do anything either.
How can I solve this problem? All the help you all can give me....
That computer is a:
HP
windows 98sec

Thank you, Chara


----------



## Sitka (May 2, 2001)

I just booted up in prompt command and entered...
scanreg/restore
thinking it might boot up before any errors ..... NOT
I'm still get the same little blue screen saying the above stuff...
dunno? help.... Chara


----------



## ~Candy~ (Jan 27, 2001)

Will safe mode work? How far back did you go on the scanreg restore?


----------



## Sitka (May 2, 2001)

Candy, I went back a week but nothing has helped...
I'm doing a registry checker now.... 
But nothing I've done is working at this point...
The only thing the computer will let me do is reboot in normal mode which won't let me do anything. I can reboot in prompt mode, safe mode but I still can't do nothing except what I type in for it to do which won't bring up nothing really.... I dunno, Chara


----------



## thumper289 (Jul 2, 2004)

if ya have compatiable viedo cards ya might try swapin them to see if your vido card died,,,sounds like something died


----------



## ~Candy~ (Jan 27, 2001)

In safe mode, are you able to see the start button? Can you type msconfig per chance?


----------



## Sitka (May 2, 2001)

There is no start botton in any mode.... none


----------



## Sitka (May 2, 2001)

I can type in ... prompt mode


----------



## ~Candy~ (Jan 27, 2001)

What happens with the recovery cd? Is the boot order in bios correct?


----------



## Sitka (May 2, 2001)

in my HP recovery I have 2 CD's. It won't boot up one of them... I can only get the 2nd one to boot up.Which will wipe out everything and start the computer over.... brand new... I even tried this but wouldn't even wipe out nothing.... 
My hubby said he was on the computer, went back to his home page, the home page did NOT open up but another page with a list and all kinds of sites, shopping, etc. popped up and then just went blank to the error message.... I've tried everything I can think of... I can boot up in safe mode, prompt command... all those but I still don't get a start botton...


----------



## Sitka (May 2, 2001)

the only thing the computer is showing at this moment is his wallpaper...
no bottons.... nothing.... if I 
ctrl/atl/delete then I can get it to boot up in another mode by hitting the F8 button .... thats how I can get that to work....


----------



## ~Candy~ (Jan 27, 2001)

I'm not sure what else to suggest. What happens if you go step by step, and perhaps say no to autoexec.bat and config.sys.


----------



## Sitka (May 2, 2001)

the only place I can type and command is in Prompt Command... so if you have something I can type in there to trigger something or fix something then I can do it in there.... Chara


----------



## ~Candy~ (Jan 27, 2001)

Try renaming autoexec.bat to autoexec.old and the same for config.sys to config.old

You'll type

ren autoexec.bat autoexec.old

watch the spacing.


----------



## Sitka (May 2, 2001)

can I rename it in command prompt? I tried that afew mintues ago and nothing happened either.... this is crazy for this computer to do a shut down like this and was fine before that.... dunno.... Chara


----------



## ~Candy~ (Jan 27, 2001)

Yes, if you don't get an error message, it should have been renamed. Type

dir /p
and press enter 
you'll press enter to scroll forward too.
Look for those two files.


----------



## frodo6006 (Jul 3, 2004)

Hi

I found some stuff about this on computing.net forums (http://www.computing.net/windows95/wwwboard/forum/147574.html)
It seems to a trojan hijacker. It seems to a real pain to get rid of.

hopes this helps

frodo6006


----------



## Sitka (May 2, 2001)

I see those files... but what next?
I don't see where it renamed it though... ummm?
This really has me confused as to what has happened here...


----------



## Sitka (May 2, 2001)

I can get my computer to boot up but nothing is there except the wallpaper. Plus the error that I stated above comes up each time. But nothing else. I do know how to reboot my computer with only using my keys which helps me at times like this. But the only thing I can bring up is safe mode, command prompt, etc. just those 5 commands....
So for me to even get to the web on that computer is impossible. I can't even get to my programs...nothing.... dunno... Chara


----------



## frodo6006 (Jul 3, 2004)

You might try some of the sites at (http://inetexplorer.mvps.org/data/e47250.htm)

It's messed up your startup files and the general consensus 
some registry editing is required. Have you tried scanreg /fix from a: prompt?

frodo6006


----------



## frodo6006 (Jul 3, 2004)

sorry a meant a: prompt from a boot disc.

frodo6006


----------



## Sitka (May 2, 2001)

yes, I did that already.... yep..... scanreg/fix..... yep I did that one... 
if I could get the start botton then I could get to my computer files and maybe do something.... I get nothing....


----------



## Sitka (May 2, 2001)

the only disc I have are the HP recovery ones... I can't even get them to work or to pull up on the computer.... 
So I feel so stuck here....


----------



## frodo6006 (Jul 3, 2004)

Did you try scanreg from a command prompt in windows or from a startup disc?

On my HP the startup is from CD then floppy then hard disc, I don't see why your recovery discs won't work, something very strange here. 

i've had blank screens and splash screens hangs but have always been to run scanreg from a boot disk. 

frodo6006


----------



## kilowatt1 (Oct 27, 2001)

Go to this site and download and save the GPIXFIX DOS.ZIP file somewhere on the hard drive so you can find it. Insert a Win98 boot (start up) in the computer you save the file to. Now locate the file and unzip the contents to the startup disk. Once complete take the startup disk to the problem computer and boot up with it, choosing not to "start with CDRom support". At the A:\> prompt type "NOVIRUS.BAT" (without the quotes) then press enter. When finished, remove the startup disk and reboot normally.

Good luck.

Kilowatt


----------



## ~Candy~ (Jan 27, 2001)

KW, have you seen this problem before? I can't find too much on it. Are you expecting a virus did this?


----------



## kilowatt1 (Oct 27, 2001)

Hello Candy,

I thought I had seen this before last summer sometimes. After searching through my favorites I found a link I had saved to DougKnox site. Hold on and I'll post the link for you.

KW


----------



## kilowatt1 (Oct 27, 2001)

Here is the link. http://inetexplorer.mvps.org/data/e47250.htm


----------



## Sitka (May 2, 2001)

KW, I don't have a Win98 boot up disc....
all I have is a recovery cd and it isn't working...
SO, can I download the file you are talking about from this computer, then put it in the next computer and download to that computer? will this help me? I can not get to my start button on the other computer because its not loading.. whatever I do I have to do from this computer and then download from a cd to the next computer. If I can get the cd to load.... this has me confused.... Chara


----------



## kilowatt1 (Oct 27, 2001)

What operating system is on the computer you are using now?


----------



## Sitka (May 2, 2001)

this is the only things working....
I boot up the computer, to goes to the wallpaper..... nothing else... just a picture that is on the computer..... no start buttons, nothing... 
So, I can ctrl-alt-delete.... hit it twice and when the computer starts re-booting then I start hitting F8 button repeating until it opens up 
"Microsoft Windows 98 Startup Menu"
Which is 6 differnt modes I can work out of...
1. normal
2. logged (\bootlog.text)
3. step-by-step confirmation
4. safe mode
5. command prompt
6. safe mode command prompt only

These are the only things I can get to work on this computer. But I'm not the smartest with computers either.... LOL
Chara


----------



## kilowatt1 (Oct 27, 2001)

Chara,

You will need to create a startup disk on the computer you are using to connect to this site, if it is also running Win98. If not you can download a boot disk from www.bootdisk.com, save it to the desktop then double click on it and follow the directions for making the startup disk. Once this is done then you can download the other file I pointed you to and unzip it to the startup disk you just created, again using the computer you are using to log into TSG.


----------



## Sitka (May 2, 2001)

when i go to www.bootdisk.com
which one do I click on.... this is a whole web site...
The computer I'm using is a XP but the computer I'm trying to fix is 98se


----------



## kilowatt1 (Oct 27, 2001)

Sorry about that. HERE you go. Download the Windows98 OEM.


----------



## Sitka (May 2, 2001)

KW, I'm having problems trying to get this file to load on this floppy.... I wonder what the problem is with this... and this is the good computer 
Gosh, this just instead my day sweetie... ummm? 
I downloaded the win98 file to my desktop, then I put in a floppy, then tried opening it, it said to put in a floppy, did that... it won't load it... ummm?
*trying here* Chara 

here the error I'm getting on this computer-

error-
Disk error on track 0
head 0
Sector not found

abort - retry - ignore

I've re-tried afew times and I get the same thing... I can't figure this one out at all.... ummmmm.... Chara


----------



## kilowatt1 (Oct 27, 2001)

What exactly does it say when you put the floppy in?


----------



## kilowatt1 (Oct 27, 2001)

Put the floppy in the drive. Then click on My Computer on the desktop. Now right click on the floppy drive and choose Format. Use either quick erase of full. Once it is formatted, try making the boot disk again.


----------



## Sitka (May 2, 2001)

my computer says nothing.... but I click on the file I downloaded to my desktop and it says load the floppy.... I load it then it starts to load it on the floppy and only gets to 1% then I get the error stated.....

error-
Disk error on track 0
head 0
Sector not found

abort - retry - ignore


For some reason it is not loading on the floppy..... I can download it to a CD but it won't do me much good since I can't get the other computer to open it.... ummmm? This is wearing me down today...  
Thanks KW for taking time with me.... Chara


----------



## kilowatt1 (Oct 27, 2001)

Our posts crossed in the mail. Try formatting the floppy. If it still doesn't work try another floppy.


----------



## Sitka (May 2, 2001)

KW, this is a new box I just opened to do this with. They should be empty.. New out of the package.... The rest of them are the same thing.... new...
But when I tried formatting it it said it couldn't because something was using it.... how can that be? ummmm? Chara


----------



## kilowatt1 (Oct 27, 2001)

What operating system is on that computer?


----------



## Sitka (May 2, 2001)

you've said that twice and I really don't understand what you're saying. 
*I'm sorry*
This computer that I'm using is XP

IS that what you're talking about? *sorry* Chara


----------



## Sitka (May 2, 2001)

okay............ *sorry re-booted*
I finally re-booted... shut everything down and then right clicked on the bootdisk file I have on my desktop. I said send it to the floopy...
Well, this is the error I got this time....

An Unexpected I/O error has occurred


This is telling me that this floppy can not be formatted for some reason. And these are NEW.... I tried everyone in the box thinking that maybe something was wrong with them... who knows... What can we do to solve this problem? I'm at a dead end here trying to think.... Thank you so much for trying to help me and taking this time with me... Chara


----------



## kilowatt1 (Oct 27, 2001)

Yes WinXP is what I was asking about. Try this. Open MY Computer. Right click on the A: drive. Choose format. In the format window place a check next to "create an ms-dos startup disk. Click start. Also make sure that the write protect tab is not set on the floppy disk.


----------



## Sitka (May 2, 2001)

okay, this is what I got this time..... my gosh dern! LOL 

"it is Write protected"

what does this mean? That I can't put just anything on this floppy? What could they be used for if not for putting info on them? I'm lost 
Chara


----------



## kilowatt1 (Oct 27, 2001)

Look at the back of a floppy disk. You'll see a little tab that slides up and down. Move it to the opposite direcrtion from where it is. Usually if you can see thru the little square it is write protected.


----------



## Sitka (May 2, 2001)

Okay.... can you believe this.... I finally kept working with it and got it to make a Dos disk.....
so now what should I do ? Chara


----------



## kilowatt1 (Oct 27, 2001)

See if you can make the boot disk now.(Leave the floppy in the drive and double click the file you saved on the desktop. If it ask you aboput overwriting the existing files allow it to do so.


----------



## Sitka (May 2, 2001)

it did... and its finished now.... whew!
Maybe we can get somewhere now.... *smiles* Chara


----------



## kilowatt1 (Oct 27, 2001)

:up: OK. If you don't already have it installed on the XP computer go HERE and download/install Winzip. Don't worry about the 21 day notice. Once that is installed, download the file from the link I posted earlier (the one that will hopefully take care of the problem on the other computer.) You will then unzip it's contents to the floppy you just made.


----------



## ~Candy~ (Jan 27, 2001)

kilowatt1 said:


> Here is the link. http://inetexplorer.mvps.org/data/e47250.htm


I saw that link in my googling.......perhaps I didn't dig down deep enough in the individual links there?


----------



## Sitka (May 2, 2001)

okay..... *smiles*
I took this floppy to the other computer, put it in, turned on the computer, it took me to the screen which shows the error, I hit ctrl-alt-del to re-boot, then starting hitting F8 repeating until it gave me the mode screen, I clicked on command prompt..... then typed in NOVIRUS.BAT
nothing... it gave me nothing... it said that it couldn't read that file... 
not sure if I did this right... but what do you think I did wrong?
Thank you, Chara


----------



## kilowatt1 (Oct 27, 2001)

You are going to have to set the Boot order to the floppy first. Reboot the computer and immediately start tapping the delete key (might be F1 or F2 key instead of the delete key). Once you get into the setup change the boot order so that the floppy drive is first in the order. Save changes and exit. Then put the startup disk you made in the floppy and reboot. I will check back in a bit.........I have to run an errand. I see that Candy is back online so I'm sure she'll jump in to help.


----------



## Sitka (May 2, 2001)

I went in there.... nothing actually said the word .... floppy...
So I guessed afew times as to what to click on and change....
but everything I did didn't let the floppy boot up......
not sure what to really click on....
Chara


----------



## kilowatt1 (Oct 27, 2001)

When you enter the BIOS setup, do you see a listing at the top of the page that says something like "Boot"? Under that section you will see some devices listed similar to this:
1 Removable Device [legacy floppy] (might say something different)
2 IDE Hard disk
3 ATAPI CD-ROM
4 Other Boot Device

This is where you need to set the floppy drive so that it is first. (It might be listed as 1.44MB, 3.5 in. or something similar.

Once you find it and set the floppy drive to boot first then you will need to get to the EXIT tab and select "save changes" before rebooting.

Do you have a manual that came with the computer? If not which model is it? Example:
HP Vectra XXX, HP 4333, etc.


----------



## Sitka (May 2, 2001)

HP 6640C

This is what's on the front of the computer.... anything else? I'll look for something else if you need it....Thanks, Chara


----------



## Sitka (May 2, 2001)

the floppy is already listed as 1.44 mb

I think I did everything right.... now what should I do? Chara


----------



## kilowatt1 (Oct 27, 2001)

If the 1.44 is first in the boot order and you saved changes before exiting then the computer should boot off the floppy drive before it ever gets to the windows error screen. Turn the computer completely off and insert the startup disk in the floppy drive. Turn on the machine. If it goes to the Windows error screen then either the floppy drive is still not set to boot first or there is something wrong with the startup disk you made.

When you use F8 and select "command prompt only", are you getting a C:\> prompt? If so, at the C:\> prompt type A: then press enter. At the A:\> prompt type NOVIRUS.BAT then press enter. (Be sure the startup disk is in the floppy drive)


----------



## Sitka (May 2, 2001)

I've tried 5 times to get this floppy to work. NO luck! 
I even got another new one and Re-loaded it again with the boot-up and with novirus again... this one does not work either.... I'm stumped... Not sure what I'm doing wrong here.... just not sure... 
I went to command prompt and put in A:\NOVIRUS.BAT
and it said that it couldn't find it.... abort/retry/fail
thats what I got each time...
So I'm really not sure what to do next. I know it has to be something I'm doing wrong here.... *I'm sorry* 
You've taken so much time with me and I'm doing something wrong here.... dunno
Chara


----------



## ~Candy~ (Jan 27, 2001)

KW, not sure about you, but I'm beginning to think the floppy drive isn't working.


----------



## Sitka (May 2, 2001)

nope, its not and I have no idea what to do from this point on.... I can hear the floppy clicking but the command prompt keeps telling me that its not reading it.... or something to that effect.... so not sure what to do at this point....help! Chara


----------



## ~Candy~ (Jan 27, 2001)

Has this floppy drive EVER worked? Can you find a disk that it used to be able to read?


----------



## Sitka (May 2, 2001)

to tell you the truth..... I've never used a floppy in it since I bought it new.... no reason too....


----------



## ~Candy~ (Jan 27, 2001)

Ok, at this point, I'm not sure what to suggest. I'm calling it a night right now......I'll ponder it til morning.....


----------



## Sitka (May 2, 2001)

okay, thank you..... 
I'll jump back on in the morning and see if there is anything I can do from this point on. Chara


----------



## ~Candy~ (Jan 27, 2001)

As a homework assignment, if you are up to it, take the floppy out of the case and try to read ANY floppy disk.....I have seen them screwed in too tightly, not tight enough, or if they have an oval face, they just aren't close enough to the front of the case and you'll get read errors. 


NITE NITE, now


----------



## Sitka (May 2, 2001)

Does anyone have any ideas on how to help me solve this problem? Still needing some help... Thanks! Chara


----------



## ~Candy~ (Jan 27, 2001)

Did you try my suggestion above?


----------



## gosox55 (May 23, 2003)

Can you still get a command prompt in windows? (C
If So try get to the floppy from there type in A: and hit enter
If a A: prompt comes up type in Air, that will tell you if your file to fix the problem is on the disc.


----------



## kilowatt1 (Oct 27, 2001)

Hello Chara,

The problem is that WinXP is not creating a proper boot disk. I have opened the .bat file to see what is involved and I think we can run it manually on the problem machine from a command prompt. Most of it is straight foward, however I need to find someone to help with creating the Registry merge file in DOS. I have posted the contents of the .bat file below.

Del C:\Windows\System\shellexpl.exe
Del C:\Windows\System\hndldt.ini
Del C:\Windows\System\winhndl.ini
c:\windows\Regedit.exe NOVIRUS.REG

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Run]
"Explorer"=-

Hang in there.........we'll eventually get it.


----------



## gosox55 (May 23, 2003)

Hello again,
Kilowatt has got it i think. Can you make or borrow a boot disc from a friend's 98 or me computer?


----------



## Sitka (May 2, 2001)

Hello Everyone! here this morning... Sorry I didn't check this last night...
I tried everything I could trying to get things to work but - nothing...
So you all just let me know what to do and I'll do it.... I'll pop in and out all day checking to see if you all posted anything... I don't know anyone that even knows anything about a computer or has a boot up disk. So I'm really not sure how I can do this. No way to get my hands on a 98 CD.. 
Thank you! Chara


----------



## ~Candy~ (Jan 27, 2001)

You tested a floppy drive and disk outside of the computer case?


----------



## quickmatch (Jul 6, 2004)

I apologize for interrupting, but does the problem below sound related to Sitka's problem? Should I follow the same problem solving path? Any advice would be greatly appreciated. Also, if it is appropriate, I would be happy to start this discussion as a separate thread.

I have encountered a major problem with my computer and I hope someone out there has a solution that will help me recover my data.

I use a Compaq Presario desktop, Pentium 3, running Windows ME. Recently the machine was very unstable and I decided to use the System Restore utility to reset the machine to a date several weeks previous to see if that would help clear up the problem. Unfortunately, the restore seems to have trashed my machine.

The machine will boot and the Windows ME screen will flash briefly. The screen then goes black, except for the curser. There are no icons or any other desktop elements displayed. I am able to move the curser using the mouse. When I hit Ctrl-Alt-Del, the Task List window that usually shows which processes are running is completely empty. I am able to select the button options (Shutdown, End Task, Cancel) at the bottom of the dialog box using either the keyboard or the mouse.

Booting in safe mode yields the same results, except with a lovely gray screen, rather than pitch black.

I tried booting with my quick restore CD in the drive and I get a menu of 5 choices. One of the choices mentions that no user profile can be found. Might this be the root of the problem?

The last resort on the CD is a complete system restore to original factory settings with a total loss of all data files not originally on the machine. Because my backup has been sloppy this is definitely a solution of last resort.

Any ideas out there on what I did to my machine and can it be fixed?


----------



## gosox55 (May 23, 2003)

If you have a startup disc and can boot to an a: prompt you might try scanreg /fix or scanreg /restore.


----------



## quickmatch (Jul 6, 2004)

gosox55 said:


> If you have a startup disc and can boot to an a: prompt you might try scanreg /fix or scanreg /restore.


Thanks, Gosox. I will give that a try when I get home tonight.

I'd like to take this opportunity to thank everyone who participates in and lends their expertise to user forums in general and this forum in particular. It's nice to see that altruism actually exists.

Quickmatch


----------



## gosox55 (May 23, 2003)

Sitka

You could try to download a 98 boot disc from fhttp://www.bootdisk.com.
and see if you access it from a windows dos prompt. If so then put the fix on it. I think kilowatt's right the XP has made a incorrect boot disc.

gosox55


----------



## Sitka (May 2, 2001)

I did a scanreg/fix and a scanreg/restore and I still have nothing working.....


----------



## gosox55 (May 23, 2003)

Sitka

sorry the scanreg /fix and scanreg /restore was for quickmatch.

If you can get a good 98 startup disc try scanreg c: from its a: prompt. If so it should give you a list of options to try without windows being involved. 

gosox55


----------



## Sitka (May 2, 2001)

Gosh, I hope someone is here to help me....
okay..... I never could get the bootdisk to work for me. So I loaded the NOVIRUS file on a floppy ALONE.... I then booted my computer and went into command prompt and then entered...

A:
it popped up.... so then I entered..... A:dir - clicked enter.... and it said that NOVIRUS file WERE there on the floppy...
So then I entered.... A:NOVIRUS.BAT ---- I hit enter and this is what it gave me......


A:\>NOVIRUS.BAT

A:\DEL C:\Windows\System\Shellexpl.exe

A:\DEL C:\Windows\System\Hndldt.ini
FILE NOT FOUND

A:\DEL C:\Windows\System\winhndl.ini
FILE NOT FOUND

A:\DEL C:\Windows\Regedit.exe. NOVIRUS.REG
IMPORTING FILE (100% COMPLETE)





Clue me in on what to do next..... I've loaded (4) floppy 98se bootdisk but none of them are working on the computer. So I think that my XP computer is not loading them right... Really not sure though. But the NOVIRUS floppy worked just fine so its not my floppy loader that not working....
Help, Chara


----------



## Sitka (May 2, 2001)

OKay... I got the bootdisk to work but I still can't get my computer to boot up....
not sure if I'm doing something wrong again or what..... ummmm?
okay, this is my opinion.....
The bootdisk has worked but I have (2) files missing which the Trojan has hooked itself to.... because they are there but my computer is saying they are not there...
Gpix
This is an adware trojan that displays adult content advertising based on the websites visited by the infected user. When run, it displays a fake error message: 



The trojan then copies itself to the WINDOWS SYSTEM (%SysDir%) as shellexpl.exe, creates a registry run key to load itself at system startup: 
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ 
Run "Explorer" = C:\WINDOWS\SYSTEM\shellexpl.exe en 
The trojan deletes all cookies in the cookies folder. 
When a cookie is created that contains these words, an adult website is contacted, and advertisements are displayed on the infected system. The trojan makes use of 2 configuration files, also in the %SysDir% folder. 
hndldt.ini 
winhndl.ini 
Those (2) files are stating they are not there when I loaded the NOVIRUS.BAT
So how can I fix this problem? I have both... bootdisk working and the NOVIRUS on the computer but it still is NOT working and I'm getting the same error....
So does anyone have a clue as to how to fix this now? Thanks, Chara


----------



## Sitka (May 2, 2001)

HEY EVERYONE I FIXED IT!!!!!
everyone has been gone today so I've worked my BUNS OFF (I wish *snicker)
trying to FIX this problem.... I really hope everyone listens to this and takes notes because I know for a fact others will need to learn this same thing....
I made the bootdisk..... alone on a floppy
I made a floppy loaded with the gpixfix......
I never could get them to load together on the same floppy for some reason... but it might have just been ME..... I'm not the smartest person when it comes to computers.
But I loaded the gpixfix floppy first...... then I ran the bootdisk after.... and I didn't used the cdrom.... nope...
I ran all this from command prompt because I really couldn't get to anything else in my computer....
then I started going down the list of everything I could think of to type in to fix this problem....
I decided to go back and look at the error once more and study it for any clues...
in the top left corner was the word...... explorer.......
so I rebooted and came back up in command prompt....
I RENAMED explorer.exe to explorer.old
I then rebooted and the computer came right back up.....
I've ran through afew things and everything seems to be fine.... so do you think I need to do anything else here? Are the trojans that did this still on the computer or are they gone with the gpixfix? Clue me in here... I really do hope you all that tried helping read this and that way you all can help others.... thank you all for the super help and support I've gotten.... Thanks, Chara


----------



## Sitka (May 2, 2001)

I can tell from playing with the other computer for afew minutes that it is very buggy. Will I be running into any problems with re-naming explorer like I did? 
I'm running into alittle problem now.....
The computer keeps telling me that the file "Shellexp" is NOT responding.
Clue me in please.... Thanks, Chara


----------



## kilowatt1 (Oct 27, 2001)

:up: Good work Chara.

There may still be an entry in the registry trying to load the rogue program.

Do this: Go to Start/Run. Type in regedit then press enter. Expand the registry tree by clicking on the + sign next to:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion

Now click on Run. Do you see anything in the right hand pane that says 
"Explorer"=c:\windows\system\shellexpl.exe oranything else that looks odd?


----------



## Sitka (May 2, 2001)

nope.... 

hpsysdrv
keyboard manager
realtray
scan registry
task monitor

The above items are the only things in there.....
What else should I do....?
When I went to the gpixfix site they spoke about the shellexpl.exe
and the other 2 files that my computer is saying can NOT be found...
I'm still VERY buggy.... I did have afew ODD things loading on start-up in my msconfig. when I checked it... So I unchecked them.... But I would have to go into the registry to clear them out and I'm not really sure if I could find them. Its been afew years since I've done that and not sure I remember how... But anything you can think of for me to do? Thank you, Chara


----------



## kilowatt1 (Oct 27, 2001)

Yes that looks good. Try this. Go to start/settings/folder options. Click on view. Put a checkmark next to "Show all files". Also click on to clear the box next to "Hide all file extensions for known file types. Then go to Start/Find/files-folders and do a search for shellexpl. Be sure you are looking in the C: drive and include subfolders is checked. You might also want to search for hndldt and winhndl as well. See if any turn up.

If you can access the internet run and post a HijackThis log for us to take a look at. Take a look in the security forum for links and instructions for HijackThis. In fact it would be a good idea to post the results in a new thread in Security so the guru's in there can take a look at it.


----------



## Sitka (May 2, 2001)

okay....
I did a file search for shellexpl. and it came up nothing.....
NO FILE by that name..... ummmmm?
BUT.... I just did a file search for "Shellexp." which is the one I was getting a NO respond to and its in here..it came up "Shellexp.exe".. under....
C:\Windows\System
C:\Windows\Applog

I also did a file search for these (2) files and nothing came up.. they are not even in the computer. 

Hndldt.ini
FILE NOT FOUND

winhndl.ini
FILE NOT FOUND

Are these files something I need? They were mentioned on the gpixfix web site... Thank you, Chara else should I do? I really didn't understand the Hijack stuff you were talking about. I can get on the internet on that computer.. yep!
So let me what to do next or if you can think of something... its very buggy still
Thank you, Chara


----------



## Sitka (May 2, 2001)

I forgot how to do a log its been so long..... clue me in again.... dah! LOL
okay... I found the hijack stuff but now I have to do the log.... Thanks, Chara


----------



## kilowatt1 (Oct 27, 2001)

Download, Unzip and run HijackThis. Then click Scan > Save log, save the log as a .txt file and copy & paste its content into your next post.
Don´t fix anything yet.

By the way, shellexp.exe is a porn popup trojan. Use CTRL/Alt/Delete to see if it is running (probably listed as c:\windows\system\shellexp.exe) and end task it.

Then locate the file and delete it.

I forgot to mention earlier that explorer.exe is not supposed to be in the root C:\> drive. The real explorer.exe is in C:\>Windows\System. So renaming it did no harm.


----------



## Sitka (May 2, 2001)

Logfile of HijackThis v1.97.7
Scan saved at 8:20:38 PM, on 7/6/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP2 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSGLOOP.EXE
C:\WINDOWS\SYSTEM\MSG32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\HPSYSDRV.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMKEYBD.EXE
C:\WINDOWS\TASKMON.EXE
C:\PROGRAM FILES\CLOCKSYNC\SYNC.EXE
C:\PROGRAM FILES\WLOX WEATHER WIZARD\TRUEWEATHER.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\KEYBDMGR.EXE
C:\PROGRAM FILES\NETROPA\ONSCREEN DISPLAY\OSD.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMUSBKB2.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\UIZEIHKR.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\WINZIP\WINZIP32.EXE
C:\UNZIPPED\HIJACKTHIS1977[1]\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://216.65.101.250/sbms/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://216.65.101.250/sbms/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://216.65.101.250/sbms/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wlox.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.pagesubmit.com/search/side.shtml
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://216.65.101.250/sbms/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://drvvv.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/ext/hp/search.html
O2 - BHO: Curl - {A78CC2FF-6E4E-4556-B27C-D7C3A70D7A50} - C:\WINDOWS\SYSTEM\NDRV.DLL (file missing)
O2 - BHO: (no name) - {34F34305-9544-2E92-8753-60550DA62F10} - C:\WINDOWS\SYSTEM\ITFQG.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: McAfee VirusScan - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\VSCSHELLEXTENSION.DLL
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [Keyboard Manager] C:\Program Files\Netropa\One-touch Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun 
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKCU\..\Run: [Explorer] C:\WINDOWS\SYSTEM\shellexp.exe en
O4 - HKCU\..\Run: [ClockSync] "C:\Program Files\ClockSync\Sync.exe" /q
O4 - Startup: WLOX Weather Wizard.lnk = C:\Program Files\WLOX Weather Wizard\TrueWeather.exe
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Yahoo! Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
O16 - DPF: Serome Web2Phone - http://www.dialpad.com/applet/vscp.cab
O16 - DPF: {73020B72-CDD6-4F80-8098-1B2ECD9CA4CA} (HearMe VoiceCREATOR) - http://vp.hearme.com/products/vp/embedded/plugins/evp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {38578BF0-0ABB-11D3-9330-0080C6F796A1} (Ctp Class) - http://www.americangreetings.com/create/Install/AxCtp.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {99B42120-6EC7-11CF-A6C7-00AA00A47DD2} (Label Object) - http://activex.microsoft.com/controls/iexplorer/x86/ielabel.cab
O16 - DPF: {5F03EAB4-1AD5-11D4-AE99-0050DAC24E8F} - http://www.iwon.com/ct/in_wn/iwonslot1,0,1,5.cab
O16 - DPF: {B5AC24C2-1B3B-11D4-80FD-005004993CCA} - http://toolbar.excite.com/download/exbar.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Control) - http://communities.msn.com/scr/MsnPUpld.cab
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! WebCam Upload Wrapper) - http://chat.yahoo.com/cab/yuplapp.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/20011223/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTicketsInstaller.cab


----------



## Sitka (May 2, 2001)

I just wanted to say.....
The hijacker... (Trojan) that took over the computer took it to....

www.weathsr.com

YES... I wrote it right..... you think its should be weather but its not. It has the S in there....
It made that site my new Home Page.... then the computer died...
then the troubles started. But atleast I can get into the computer now.
My computer is also still very buggy. And I have DSL and this computer was fast not it is SLOW>VERY SLOW.... help...

and YES...... Shellexp.exe was running on the computer and I just ended task on it... going to delete it now.... thanks.... Chara


----------



## kilowatt1 (Oct 27, 2001)

Run HJT again and place a checkmark by the following to be fixed. Then close all browser windows except HJT and click on the fix button.

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://216.65.101.250/sbms/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://216.65.101.250/sbms/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://216.65.101.250/sbms/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.pagesubmit.com/search/side.shtml

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://216.65.101.250/sbms/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/ext/hp/search.html

O2 - BHO: Curl - {A78CC2FF-6E4E-4556-B27C-D7C3A70D7A50} - C:\WINDOWS\SYSTEM\NDRV.DLL (file missing)

O2 - BHO: (no name) - {34F34305-9544-2E92-8753-60550DA62F10} - C:\WINDOWS\SYSTEM\ITFQG.DLL

O4 - HKCU\..\Run: [Explorer] C:\WINDOWS\SYSTEM\shellexp.exe en

O16 - DPF: {5F03EAB4-1AD5-11D4-AE99-0050DAC24E8F} - http://www.iwon.com/ct/in_wn/iwonslot1,0,1,5.cab

O16 - DPF: {B5AC24C2-1B3B-11D4-80FD-005004993CCA} - http://toolbar.excite.com/download/exbar.cab

When finished run another scan and post a new log.

I have to leave for the night. I'll check back in the AM.

Kilowatt


----------



## Sitka (May 2, 2001)

C:\WINDOWS\SYSTEM\UIZEIHKR.EXE

the above really don't look right.... of course I really don't know what all this is but this one really looks odd...... ODD.... *smiles* Chara


----------



## Sitka (May 2, 2001)

This is the new one..... I still don't like the looks of the above file..... but...

Logfile of HijackThis v1.97.7
Scan saved at 9:03:40 PM, on 7/6/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP2 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSGLOOP.EXE
C:\WINDOWS\SYSTEM\MSG32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\HPSYSDRV.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMKEYBD.EXE
C:\WINDOWS\TASKMON.EXE
C:\PROGRAM FILES\CLOCKSYNC\SYNC.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\KEYBDMGR.EXE
C:\PROGRAM FILES\NETROPA\ONSCREEN DISPLAY\OSD.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMUSBKB2.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\UNZIPPED\HIJACKTHIS1977\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wlox.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://drvvv.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=5.5&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://home.microsoft.com/access/autosearch.asp?p=%s
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: McAfee VirusScan - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\VSCSHELLEXTENSION.DLL
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [Keyboard Manager] C:\Program Files\Netropa\One-touch Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun 
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKCU\..\Run: [ClockSync] "C:\Program Files\ClockSync\Sync.exe" /q
O4 - Startup: WLOX Weather Wizard.lnk = C:\Program Files\WLOX Weather Wizard\TrueWeather.exe
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Yahoo! Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
O16 - DPF: Serome Web2Phone - http://www.dialpad.com/applet/vscp.cab
O16 - DPF: {73020B72-CDD6-4F80-8098-1B2ECD9CA4CA} (HearMe VoiceCREATOR) - http://vp.hearme.com/products/vp/embedded/plugins/evp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {38578BF0-0ABB-11D3-9330-0080C6F796A1} (Ctp Class) - http://www.americangreetings.com/create/Install/AxCtp.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {99B42120-6EC7-11CF-A6C7-00AA00A47DD2} (Label Object) - http://activex.microsoft.com/controls/iexplorer/x86/ielabel.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Control) - http://communities.msn.com/scr/MsnPUpld.cab
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! WebCam Upload Wrapper) - http://chat.yahoo.com/cab/yuplapp.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/20011223/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTicketsInstaller.cab


----------



## quickmatch (Jul 6, 2004)

You guys rock!

After creating a boot disk (using kilowatt1's most excellent advice) I followed gosoxx55's suggestion and ran scanreg/fix. My machine choked on that process about two minutes into the scan. I then tried scanreg/restore. THAT went through OK. I then rebooted and, a minute or so later, to the sound of heavenly strings and celestial choirs, Windows opened! I spent the rest of the night backing up my data in preparation for some serious cleanup work over the next week or so.

Again, thanks.


----------



## Sitka (May 2, 2001)

So glad everything has worked out for you... As these computers can stress us alittle at times. And I'm always learning something new with them. But its great that everything worked out great for you... *smiles* Chara


----------



## gosox55 (May 23, 2003)

Quickmatch

Great news. Startup Discs sure are handy tools to have.

gosox55


----------



## kilowatt1 (Oct 27, 2001)

Hello Chara,

How's the problem machine running now? There is still a couple of entries that need to be cleaned up.


----------



## Sitka (May 2, 2001)

its still buggy, very-very slow..... So I've went in there and cleaned up afew things from add/remove....
Stuff that just wasn't needed on that computer....
Since its up and running again I did another scanreg/fix on it to make sure things were okay, I went to microcsft and did a windows update...
I tried to get the HP system recovery disc I have to work and it still will NOT open and start. I'm thinking I have afew files missing and was going to restore some things. But I can't get it to work and really not sure where to get another one on the internet inless maybe in Znet or Cnet...dunno...
So right now I'm running a ScanDisk on the computer to check files and folders for errors and a disk scan for surface errors.... It keeps telling me that it can't complete the scan for some reason... So I just checked and made sure everything was shut down for it to work right... I tried the scanning awhile ago and it said I had a file missing to operates the scan. So thats why I was trying to do a system recovery for some folders... ummmm? 
I haven't used that computer in almost 3 years. I just put it back online afew weeks ago and then all this has happened to it. I need to find a good FREE virus protection for that computer so if you know of one clue me in please *wink*
Let me know what you think I need to do to get the bugs out. The scanning of the disc must be working this time because it hasn't stopped again. So maybe I had something running that was messing it up. But thank you for staying with me here. You've been the Best! *smiles* Chara


----------

