# [Resolved] Xupiter "infection" and startup/registry problems



## gyrate (Jul 1, 2001)

I actually began this thread in "All Other Software" because the primary "victim" of my problem is WinOnCD 5.0. But the trouble really began with a Xupiter "invasion" of my computer about two months ago; I thought I'd eradicated it completely, but I am still having problems with WinOnCD, as well as with my startup programs and probably the registry itself. When running WinOnCD's "disc copy" function, I almost always get an "illegal operation" box that states WinOnCD caused an invalid page fault in either kernel32.dll or MFC42.dll. I also get the same message at times when I close (yes, only when I close) the Windows Plus! 98 Deluxe CD player. From reading other threads in the forums I have surmised my problems might actually reside in my system registry.
Yes, I have contacted Roxio.de tech support; they believe it is a Windows problem. In order to (hopefully) overwrite bad files, I have also reinstalled Windows 98 SE (twice), and I've run Spybot, Hijack This, Regclean, Regmech, and Advanced System Optimizer. But my problem remains. After the second of my Windows reinstalls, I also began getting error messages at startup concerning these two files: spp.dll and CMSTO.EXE. I have disabled them in MSCONFIG, and I no longer get the error messages, but there's definitely something amiss here.
Any ideas?


----------



## Triple6 (Dec 26, 2002)

have you checked for a virus? www.trend.com


----------



## gyrate (Jul 1, 2001)

Yes. Checked using PC-cillin's downloadable virus scan. It found one "infected" file, which it said could not be cleaned. So (duh!) I chose to delete it without writing down what it was. This possible blunder was what led me to reinstall Windows......in the hope I would install a healthy version of that unknown file. Unfortunately, neither the virus scan/file deletion nor the Windows reinstalls made a bit of difference to my problem.


----------



## Rollin' Rog (Dec 9, 2000)

In spite of running all those programs they still did not completely eliminate a hijack infection.

spp.dll and CMSTO.EXE

They are both probably hijack files that have been somewhat renamed to avoid detection.

Do a file search for each and delete them. Then re-enable the msconfig startups. You will probably get file missing messages.

Use HijackThis to check and remove the two registry entries. You should probably post the HijackThis Scanlog as well, as there may be more that needs to be removed.

http://www.tomcoyote.org/hjt/


----------



## gyrate (Jul 1, 2001)

Sorry......forgot to add that I now have five MFC42.dll files on my computer. One is C/Windows/System, One is in C/Windows/Temp/RarSFX0, and three are associated with Nero 5.5 software (one with the basic program, one with the wave editor, and one with the cover designer). Do I have enough of these files?  And what is "RarSFX0"?


----------



## Triple6 (Dec 26, 2002)

spp.dll has something to do with a virus or spyware I'm sure.

have you tried spybot: http://www.spywareinfo.com/downloads.php update and run it.
You can also get startuplist there - post the list it generates


----------



## Rollin' Rog (Dec 9, 2000)

The one in c:\windows\system should be the highest version, and theoretically it should be the only one you really need. You can try renaming the others if you continue to get errors. If it is not the highest version, copy the highest version there and rename the others with different extensions, such as bak, old, xxx, etc.


----------



## gyrate (Jul 1, 2001)

Thanks Triple6 and Rollin' Rog, for your suggestions. I'm about to embark on another journey through Spybot and Hijack This, so I'll be busy for a bit. But before I do, let me give you all the information I can glean from my own system on the CMSTO.exe and spp.dll files. When I look for the properties of the CMSTO file, and click "version", I get: "Microsoft Connection Manager Profile Installer". (The version update was October, 2001). How fishy does that sound?
As for the "spp.dll" file.......I cannot find it through the Start>Find>Find files or folders method. But here is how it is described in my Startup file from MSConfig: 
"regedit -s C:\Windows \sp.dll". I'll see if I can find it and delete it from the Windows folder.


----------



## gyrate (Jul 1, 2001)

StartupList report, 5/30/03, 7:11:02 PM
StartupList version: 1.52
Started from : C:\WINDOWS\TEMP\TD_0001.DIR\HIJACKTHIS.EXE
Detected: Windows 98 SE (Win9x 4.10.2222A)
Detected: Internet Explorer v6.00 (6.00.2600.0000)
* Using default options
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\SYSTEM\3CMLNKW.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\SIERRA IMAGING\IMAGE EXPERT\IXAPPLET.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\TEMP\TD_0001.DIR\HIJACKTHIS.EXE

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\WINDOWS\Start Menu\Programs\StartUp]
Camio Viewer 2.0.lnk = C:\Program Files\Sierra Imaging\Image Expert\IXApplet.exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

ScanRegistry = c:\windows\scanregw.exe /autorun
TaskMonitor = c:\windows\taskmon.exe
SystemTray = SysTray.Exe
EM_EXEC = C:\PROGRA~1\LOGITECH\MOUSEW~1\SYSTEM\EM_EXEC.EXE
3Cmlink = c:\windows\SYSTEM\3cmlnkW.exe
StillImageMonitor = C:\WINDOWS\SYSTEM\STIMON.EXE
mdac_runonce = C:\WINDOWS\SYSTEM\runonce.exe
NewsUpd = C:\Program Files\Creative\News\NewsUpd.EXE /q
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=Explorer.exe
SCRNSAVE.EXE=
drivers=mmsystem.dll power.drv

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 27/5/2003, 16:5:36)

[Rename]
NUL=C:\WINDOWS\SYSTEM\SCHANNEL.DLL
C:\WINDOWS\SYSTEM\SCHANNEL.DLL=C:\WINDOWS\SYSTEM\SET5163.TMP
C:\WINDOWS\SYSTEM\IEPEERS.DLL=C:\WINDOWS\SYSTEM\IEPEERS.RCX
C:\WINDOWS\SYSTEM\RSASIG.DLL=C:\WINDOWS\SYSTEM\IE4SETUP\RSASIG.DLL
C:\WINDOWS\SYSTEM\XENROLL.DLL=C:\WINDOWS\SYSTEM\IE4SETUP\XENROLL.DLL
C:\WINDOWS\SYSTEM\MSCAT32.DLL=C:\WINDOWS\SYSTEM\IE4SETUP\MSCAT32.DLL
C:\WINDOWS\SYSTEM\MSSIGN32.DLL=C:\WINDOWS\SYSTEM\IE4SETUP\MSSIGN32.DLL
C:\WINDOWS\SYSTEM\CRYPTUI.DLL=C:\WINDOWS\SYSTEM\IE4SETUP\CRYPTUI.DLL
C:\WINDOWS\SYSTEM\CRYPTNET.DLL=C:\WINDOWS\SYSTEM\IE4SETUP\CRYPTNET.DLL
C:\WINDOWS\SYSTEM\CRYPTEXT.DLL=C:\WINDOWS\SYSTEM\IE4SETUP\CRYPTEXT.DLL
C:\WINDOWS\SYSTEM\WLDAP32.DLL=C:\WINDOWS\SYSTEM\IE4SETUP\WLDAP32.DLL
C:\WINDOWS\SYSTEM\DXTMSFT.DLL=C:\WINDOWS\SYSTEM\IE4SETUP\DXTMSFT.DLL
C:\WINDOWS\SYSTEM\DXTRANS.DLL=C:\WINDOWS\SYSTEM\IE4SETUP\DXTRANS.DLL
C:\WINDOWS\SYSTEM\MSTIME.DLL=C:\WINDOWS\SYSTEM\IE4SETUP\MSTIME.DLL
C:\WINDOWS\SYSTEM\MMUTILSE.DLL=C:\WINDOWS\SYSTEM\IE4SETUP\MMUTILSE.DLL
C:\WINDOWS\SYSTEM\PLUGIN.OCX=C:\WINDOWS\SYSTEM\IE4SETUP\PLUGIN.OCX
C:\WINDOWS\SYSTEM\MSRATELC.DLL=C:\WINDOWS\SYSTEM\IE4SETUP\MSRATELC.DLL
C:\WINDOWS\SYSTEM\MSRATING.DLL=C:\WINDOWS\SYSTEM\IE4SETUP\MSRATING.DLL
C:\WINDOWS\SYSTEM\HLINK.DLL=C:\WINDOWS\SYSTEM\IE4SETUP\HLINK.DLL
C:\WINDOWS\SYSTEM\PROCTEXE.OCX=C:\WINDOWS\SYSTEM\IE4SETUP\PROCTEXE.OCX
C:\WINDOWS\SYSTEM\URL.DLL=C:\WINDOWS\SYSTEM\IE4SETUP\URL.DLL
C:\PROGRA~1\INTERN~1\IEXPLORE.EXE=C:\WINDOWS\SYSTEM\IE4SETUP\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\COMCTL32.DLL=C:\WINDOWS\SYSTEM\IE4SETUP\ACM51A2.TMP
C:\WINDOWS\SYSTEM\MSHTML.DLL=C:\WINDOWS\SYSTEM\IE4SETUP\ACM51A3.TMP
C:\WINDOWS\SYSTEM\MSHTMLED.DLL=C:\WINDOWS\SYSTEM\IE4SETUP\ACM51A4.TMP
C:\WINDOWS\SYSTEM\SHDOCVW.DLL=C:\WINDOWS\SYSTEM\IE4SETUP\ACM51A5.TMP
C:\WINDOWS\SYSTEM\SHDOCLC.DLL=C:\WINDOWS\SYSTEM\IE4SETUP\ACM51A6.TMP
C:\WINDOWS\SYSTEM\URLMON.DLL=C:\WINDOWS\SYSTEM\IE4SETUP\ACM51A7.TMP
C:\WINDOWS\SYSTEM\WININET.DLL=C:\WINDOWS\SYSTEM\IE4SETUP\ACM51A8.TMP
C:\WINDOWS\SYSTEM\SHLWAPI.DLL=C:\WINDOWS\SYSTEM\IE4SETUP\ACM51A9.TMP
C:\WINDOWS\SYSTEM\CRYPT32.DLL=C:\WINDOWS\SYSTEM\IE4SETUP\ACM51AA.TMP
C:\WINDOWS\SYSTEM\ACTXPRXY.DLL=C:\WINDOWS\SYSTEM\IE4SETUP\ACM51AB.TMP
C:\WINDOWS\SYSTEM\MLANG.DLL=C:\WINDOWS\SYSTEM\IE4SETUP\ACM51AC.TMP
C:\WINDOWS\SYSTEM\WINTRUST.DLL=C:\WINDOWS\SYSTEM\IE4SETUP\ACM51B0.TMP
C:\WINDOWS\SYSTEM\RSABASE.DLL=C:\WINDOWS\SYSTEM\IE4SETUP\ACM51B1.TMP
C:\WINDOWS\SYSTEM\BROWSEUI.DLL=C:\WINDOWS\SYSTEM\IE4SETUP\ACM51B2.TMP
C:\WINDOWS\SYSTEM\BROWSELC.DLL=C:\WINDOWS\SYSTEM\IE4SETUP\ACM51B3.TMP
C:\WINDOWS\SYSTEM\SHDOC401.DLL=C:\WINDOWS\SYSTEM\IE4SETUP\ACM51B4.TMP
C:\WINDOWS\SYSTEM\SHD401LC.DLL=C:\WINDOWS\SYSTEM\IE4SETUP\ACM51B5.TMP
C:\WINDOWS\SYSTEM\SHFOLDER.DLL=C:\WINDOWS\SYSTEM\IE4SETUP\ACM51B6.TMP
C:\WINDOWS\SYSTEM\PSBASE.DLL=C:\WINDOWS\SYSTEM\IE4SETUP\ACM51B7.TMP
C:\WINDOWS\SYSTEM\PSTORERC.DLL=C:\WINDOWS\SYSTEM\IE4SETUP\ACM51B8.TMP
C:\WINDOWS\SYSTEM\MSLS31.DLL=C:\WINDOWS\SYSTEM\IE4SETUP\ACM51B9.TMP
C:\WINDOWS\SYSTEM\DIGEST.DLL=C:\WINDOWS\SYSTEM\IE4SETUP\ACM51BA.TMP
NUL=C:\WINDOWS\SHELLI~1
NUL=C:\WINDOWS\SYSTEM\WEBCHECK.DLL
C:\WINDOWS\SYSTEM\WEBCHECK.DLL=C:\WINDOWS\SYSTEM\SET5220.TMP
NUL=C:\WINDOWS\SYSTEM\SENS.DLL
C:\WINDOWS\SYSTEM\SENS.DLL=C:\WINDOWS\SYSTEM\SET5221.TMP
NUL=C:\WINDOWS\SYSTEM\ES.DLL
C:\WINDOWS\SYSTEM\ES.DLL=C:\WINDOWS\SYSTEM\SET5222.TMP
NUL=C:\WINDOWS\SYSTEM\ESSHARED.DLL
C:\WINDOWS\SYSTEM\ESSHARED.DLL=C:\WINDOWS\SYSTEM\SET5223.TMP
NUL=C:\WINDOWS\SYSTEM\ESTIER2.DLL
C:\WINDOWS\SYSTEM\ESTIER2.DLL=C:\WINDOWS\SYSTEM\SET5224.TMP
NUL=C:\WINDOWS\fonts\COMIC.TTF
C:\WINDOWS\fonts\COMIC.TTF=C:\WINDOWS\COMIC.tt2
NUL=C:\WINDOWS\fonts\COMICBD.TTF
C:\WINDOWS\fonts\COMICBD.TTF=C:\WINDOWS\COMICBD.tt2
NUL=C:\WINDOWS\fonts\IMPACT.TTF
C:\WINDOWS\fonts\IMPACT.TTF=C:\WINDOWS\IMPACT.tt2

--------------------------------------------------

C:\AUTOEXEC.BAT listing:

SET BLASTER=A220 I7 D1 H5 P330 T6
SET CTSYN=C:\WINDOWS
C:\PROGRA~1\CREATIVE\SBLIVE\DOSDRV\SBEINIT.COM

--------------------------------------------------

Enumerating Task Scheduler jobs:

Maintenance-Clean up Start menu.job
Maintenance-Anti-Virus.job
Maintenance-Defragment programs.job
Maintenance-ScanDisk.job
Maintenance-Disk cleanup.job
Tune-up Application Start.job

--------------------------------------------------

Enumerating Download Program Files:

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\SWFLASH.OCX
CODEBASE = http://active.macromedia.com/flash2/cabs/swflash.cab

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

WebCheck: C:\WINDOWS\SYSTEM\WEBCHECK.DLL

--------------------------------------------------
End of report, 7,636 bytes
Report generated in 0.043 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only


----------



## gyrate (Jul 1, 2001)

Spybot-S&D Startup list report, 5/30/03 7:32:59 PM

Located: HK_LM:Run, ScanRegistry
file: c:\windows\scanregw.exe /autorun

Located: HK_LM:Run, TaskMonitor
file: c:\windows\taskmon.exe
MD5: F795110611101279AA15997801ABACA0

Located: HK_LM:Run, SystemTray
file: SysTray.Exe

Located: HK_LM:Run, EM_EXEC
file: C:\PROGRA~1\LOGITECH\MOUSEW~1\SYSTEM\EM_EXEC.EXE
MD5: 3B2D4750E6FF233486D56E6E1E1626F2

Located: HK_LM:Run, 3Cmlink
file: c:\windows\SYSTEM\3cmlnkW.exe
MD5: 01E8C762E87B9383661A9BC3420B55D3

Located: HK_LM:Run, StillImageMonitor
file: C:\WINDOWS\SYSTEM\STIMON.EXE
MD5: 3A395315C2D9E63C0CE4704AFA404FFA

Located: HK_LM:Run, mdac_runonce
file: C:\WINDOWS\SYSTEM\runonce.exe
MD5: A7B12C44898DB55F2755199EB2F2087A

Located: HK_LM:Run, LoadPowerProfile
file: Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

Located: HK_LM:RunServices, LoadPowerProfile
file: Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

Located: Startup (user), Camio Viewer 2.0.lnk
file: C:\Program Files\Sierra Imaging\Image Expert\IXApplet.exe
MD5: 08907DC294CAD9BCE7B10F41B44B07D9


----------



## Rollin' Rog (Dec 9, 2000)

Run the HijackThis ScanLog, not the Startuplist, and remove the reference for this line:

mdac_runonce = C:\WINDOWS\SYSTEM\runonce.exe

It's a legitmate MS file, but it is left in startups by a bug.

http://support.microsoft.com/default.aspx?scid=KB;en-us;q268062

Also, to ensure you don't have any hijack related registry entries for search and start pages, we really need to see a post of the Scanlog.

The startuplist looks pretty clean...

You might want to have a gander at this, though for what it's worth:

http://www.cexx.org/newsupd.htm


----------



## gyrate (Jul 1, 2001)

Rollin' Rog....
Removel of the "runonce" file done. Here is the scanlog:
Logfile of HijackThis v1.94.0
Scan saved at 8:12:27 PM, on 5/30/03
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar=about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://65.90.159.8/warning.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL=about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant=about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch=http://drvvv.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page=
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\LOGITECH\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [3Cmlink] c:\windows\SYSTEM\3cmlnkW.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - Startup: Camio Viewer 2.0.lnk = C:\Program Files\Sierra Imaging\Image Expert\IXApplet.exe
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://active.macromedia.com/flash2/cabs/swflash.cab


----------



## Rollin' Rog (Dec 9, 2000)

These don't look copacetic to me; I would check them and have HijackThis remove or restore the MS default by clicking 'fix':

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://65.90.159.8/warning.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch=http://drvvv.com/

Both appear to be "x" related hijacks

That would make for a 'clean' list of basic installs, are you still having any specific problems?


----------



## gyrate (Jul 1, 2001)

Unfortunately, yes. Still having the same old $%#@$ problem!

This is the "Illegal Operation" message I get when I try to open WinOnCD's "disc copy" function:

WINONCD caused an invalid page fault in
module KERNEL32.DLL at 0167:bff9db61.
Registers:
EAX=c00301a8 CS=0167 EIP=bff9db61 EFLGS=00010212
EBX=00000000 SS=016f ESP=0093ff38 EBP=009401d4
ECX=00000000 DS=016f ESI=00a50f70 FS=350f
EDX=7803b158 ES=016f EDI=004c3520 GS=0000
Bytes at CS:EIP:
53 8b 15 e4 9c fc bf 56 89 4d e4 57 89 4d dc 89 
Stack dump:

This is most vexing, because there is no problem with any of WinOnCD's other features. Audio, VCD, Data disc projects all operate beautifully. I have two CDRWs, a Plextor 48x24x48 and a LiteOn 52x24x52, and WinOnCD drives both to maximum capability. But when I try to open "disc copy", I get the above error message (or a similar one for MFC42.dll). Also, the project screen (that screen to which you'd drag and drop files, or where you'd select recording options) never shows up......so I get a monitor screen that's top-half WinOnCD, bottom-half Windows wallpaper......well, before I must abort the program, that is.

I've uninstalled/reinstalled WinOnCD about a gazillion times, both in Windows and Windows safe mode. And now I've got a system registry and startup programs that are "lean and mean". I don't know what to try next.


----------



## Rollin' Rog (Dec 9, 2000)

If you have, or have had, other CD burning software on the system, there could be a conflict.

Even after uninstalling, some burning programs may leave behind files in the c:\windows\system\iosubsys directory. These continue to load automatically at startup and run in memory.

You can check the properties > version info of files in there to see if any belong to other programs and temporarily at least, rename their extensions to old or bak so that they do not automatically load.


----------



## gyrate (Jul 1, 2001)

Thanks, Rollin'Rog. I'll go through my IOSUBSYS file. The only burning programs I've had on this machine are WinOnCD 3.8, WinOnCD 5.0, and Nero 5.5. How ironic if I find that one version of WinOnCD has been conflicting with another! I'll check back as soon as I've had a chance to search.


----------



## gyrate (Jul 1, 2001)

I tried renaming all Roxio/Adaptec virtual device drivers in IOSUBSYS, then reinstalling WinOnCD, and I found that the renamed files merely got replaced with new installs. Is there somewhere I can check/verify the validity of the Microsoft virtual device drivers in my IOSUBSYS file? 

And I fear I may not be done with Xupiter. Magically, a brand-new Internet Explorer icon just appeared in the "quick launch" portion of my Windows toolbar. Not my doing. But I thought I'd removed all Xupiter files and registry entries! Grrrrr!


----------



## Rollin' Rog (Dec 9, 2000)

You can be pretty confident they are genuine MS files if the copyright info is for MS. What does sometimes happen is that original files are replaced with updated versions. I don't know how relevant it is here, but there have been past problems with Adaptec replacing the original Microsoft apix.vxd with their own; however errors caused by this usually point directly at it in the error message.

There are some files in that directory that can be left permanently renamed to avoid conflicts. Here are three that involve the Microsoft Tape Backup utility:

drvwq117.vxd Drvwppqt.vxd Drvwcdb.vxd

all can be safely renamed with .old extensions.

The same is generally true for: Scsi1hlp.vxd which is a legacy "help" driver for scsi drives.

>>>> For the new Xupiter problem, give us another post of the ScanLog so we can see if anything is new there.


----------



## gyrate (Jul 1, 2001)

Thanks, Rollin'Rog. There are some interesting (former.vxd?) files in my IOSUBSYS file. I have no idea what renamed them.......or why. I have to go to work now, but I'll be back as soon as possible to check them out. Oh.....Microsoft's Apix.vxd had been renamed by the Adaptec Apix.vxd; I tried renaming both, but it had no effect on my problem.

My new Hijack This scanlog:
Logfile of HijackThis v1.94.0
Scan saved at 8:30:33 AM, on 5/31/03
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar=about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL=about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant=about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page=
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\LOGITECH\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [3Cmlink] c:\windows\SYSTEM\3cmlnkW.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - Startup: Camio Viewer 2.0.lnk = C:\Program Files\Sierra Imaging\Image Expert\IXApplet.exe
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)


----------



## Rollin' Rog (Dec 9, 2000)

There is nothing new in the Scanlog.

You can't really just "rename" the apix.vxd, it is a required file; where problems are clearly traceable to it, you can rename the current apix.vxd but you must restore the original by extracting it from cabinet files or the MS system CD.

The only other thing I can think of is that the issues with mfc42.dll are due to incompatible or damaged versions. Since you appear to have had mdac 2.5 on the system from the presence of that startup, you might want to try installing an updated set of files.

http://www.responsivesoftware.com/mdac.htm

further, you should rename any instance of mfc42.dll found in the Programs folder(s) of the software causing the problem. These may load in preference to the one in c:\windows\system which should be the latest and greatest.


----------



## gyrate (Jul 1, 2001)

Sorry, Rollin'Rog.......I neglected to mention I have TWO Apix files in IOSUBSYS. One is the Microsoft version that undoubtedly came with Windows 98, and the other is an Adaptec version (which may have been installed with Roxio/Adaptec WinOnCD). The Microsoft version had been renamed Apix.BAK; so I tried reversing them, renaming the MS versio ".vxd" and the Adaptec version ".old". I've since reversed them again, as my attempt didn't accomplish anything. I tried uninstalling Nero, thinking it might have been causing a conflict.......and that took care of three of my MFC42.dll files. I renamed the one in the temp file, so I now have just one valid file.......in C:\Windows\System. So far no improvements. 
I deleted the new Internet Explorer Icon from my Quick Launch toolbar.......but it is still in my Recycle bin......would the internet page it opens tell us anything about its source?


----------



## Rollin' Rog (Dec 9, 2000)

If if it is just a standard IE shortcut icon it shouldn't go to anything other than your normal Start/Homepage -- for which I see no selection in the Scanlog.

Did you try connecting through it?

You might restore it back to the desktop, but before left clicking on it, right click on it and select "properties". If it is a shortcut icon, there should be a "Target" field pointing to the program it runs. That should be IExplore.exe in the Internet Explorer Programs folder. If it is anything else, then something has managed to associate an IE icon with a different program. Don't run it.

What is the version number of the mfc42.dll you have left in windows\system?

Right click and select Properties > Version.


----------



## gyrate (Jul 1, 2001)

I followed the Internet Explorer Icon from my quick launch toolbar, and took me right to the IE homepage. So it's a legitimate/"innocent" item......it was apparently hidden to me because of my toolbar settings. 

I just ran MDAC ComCheck. The results:

Item Name	Item Type	ErrorString	Status
mtxdm.dll	File	Field 'FileVersion' mismatch: Expect '1999.9.3421.3' Got '1999.6.902.0'	Error
MSVCRT.DLL	File	Field 'FileVersion' mismatch: Expect '6.10.8637.0' Got '6.10.8924.0'	Error
odbcad32.exe	File	Field 'Size' mismatch: Expect '37136' Got '36864'	Error
STDOLE2.TLB	File	Field 'FileVersion' mismatch: Expect '2.40.4512' Got '2.40.4518'	Error
AsycFilt.dll	File	Field 'FileDescription' mismatch: Expect '' Got 'Microsoft OLE 2.40 for Windows NT(TM) and Windows 95(TM) Operating Systems'	Error
OlePro32.dll	File	Field 'FileVersion' mismatch: Expect '5.0.4512' Got '5.0.4518'	Error
OLEAUT32.DLL	File	Field 'FileVersion' mismatch: Expect '2.40.4512' Got '2.40.4518'	Error
MSADCO.DLL	COM	Unknown Class ID = {9381d8f1-0288-11d0-9501-00aa00b911a5}	Warning

I don't know what I'm looking at here, but the "MSADCO.dll" item is most strongly worded as a 'warning'. When I look the file up (Start>find files or folders) it has all the appearances of a normal, healthy Microsoft application extension. Can you interpret this for me?


----------



## Rollin' Rog (Dec 9, 2000)

That's a lot of version mismatches. Never used the checker before so this is a first look at its results for me.

The warning is no doubt because of the "unknown" class id associated with it in the registry. This could be due to registry damage or it could mean that at some point a different program registered another version of the file and it was never properly re registered. I'm just guessing here.

Also, there are so many "hits" for this in Google > Groups that I suspect it just may be a common problem or a glitch in the way the utility handles this.

http://groups.google.com/groups?q=M...s+id"&hl=en&lr=&ie=UTF-8&oe=utf-8&sa=N&tab=wg

But I'd definitely do the update with all those problems detected.


----------



## gyrate (Jul 1, 2001)

My remaining MFC42.dll file is version 6.00.8665.0. When I had five such files, they were all the same version as this one.

Rollin'Rog, could you give me a brief "tutorial" on files? Or perhaps give me a link where I might find such a tutorial? What does ".dll" mean? What do these files do? I know ".vxd" is a virtual device driver.......shouldn't IOSUBSYS contain nothing but ".vxd" files, and perhaps some others that have been renamed for various reasons? My IOSUBSYS folder contains files with the suffixes ".drv.", ".mpd" and ".pdr". Are these active files? Or are they former ".vxd" files that have been renamed by some unknown entity?

The "Web Attack" site......http://www.webattack.com offers great numbers of downloads for missing/replacement .dll files. No two of these files appear to be the same.......yet can an end user such as I assume that all MFC42.dll files I might download would do the same job for me? And if not, how do I decide which one is right? In the case of a tough-to-find problem like mine, would you recommend I rename my current MFC42 and Kernel32 .dll files, then begin trying new ones?

I feel like the child who annoys one and all with the incessant question, "why?" But I do appreciate the knowledge you're giving me!


----------



## IMM (Feb 1, 2002)

I wouldn't sweat the comcheck results.

If you have TweakUI installed - try the Repair Font Folder function on it. How many fonts are installed on your system?


----------



## Rollin' Rog (Dec 9, 2000)

I see why IMM is saying not to sweat the mismatches. Most of what you have are slightly more recent versions than the originals, and that usually is not a problem. I should have looked a little more closely at that.

"File" is the most generic term for any kind of stored data.
The specific extension on a file tells you what type of process or action is normally associated with the file. For example, dll stands for "Dynamic Link Library" and is a set of commands or functions that the calling program can access. Dlls may be specific to a particular program, or in the case of Windows, shared by many programs.

A good link for looking up terms is Webopedia:

http://www.webopedia.com/

When you want to check out the version level of a Microsoft dll, use this site:

http://support.microsoft.com/default.aspx?scid=/servicedesks/fileversion/dllinfo.asp&SD=TECH&FR=0

Here you can learn that your version of mfc42.dll is a recent one, the same as used in Windows XP, for example.

Be wary of downloading dlls from sites without checking the minimum version required by your Windows version. While you can usually (but not always) work with a higher version, lower ones may not have the required functions.

To answer your question about the iosubsys folder, I know that the files with vxd extensions are automatically loaded when Windows starts. I'm not so sure about the others -- it may depend on whether there is a specific reference to them in the registry.


----------



## gyrate (Jul 1, 2001)

Thanks for the file knowledge, Rollin'Rog! IMM, thank you for joining in! No, I do not have TweakUI installed (can you send me a link to download?), but my Windows font folder contains 540 files......presumably, this means I have 540 fonts. Believe it or not, I don't actually use them all. Is there some known problem associated with too many fonts? Or can bad font files cause problems?

Odd you'd ask about fonts, though, because it seems I've installed a couple of programs lately that brought dozens of new fonts. One that comes to mind is CD Stomper's "Click 'n Design" program, which added a bunch of new fonts to my system.


----------



## gyrate (Jul 1, 2001)

OK......I downloaded and ran TweakUI, repairing my fonts folder. There is no detectable difference; I'm still getting the page fault errors in Kernel32.dll and MFC42.dll when I attempt to open WinOnCD's disc copy function. But I still do have lotsa fonts! Would it be advisable for me to jettison a few of 'em?


----------



## Rollin' Rog (Dec 9, 2000)

I think you are well under the Fonts limits in Win98, which I believe is around a 1000 give or take a couple hundred.

There appears to be an update for the 5.0 version of Winoncd available, have you tried it?

http://www.cequadrat.de/english/support/list_servicepacks.html


----------



## gyrate (Jul 1, 2001)

I'm a registered owner of WinOnCD 3.8 PE, WinOnCD 5.0 (German), and the newest entry......WinOnCD 5.05b (USA.....WinOnCD is FINALLY available in the US again!). I've been experiencing the MFC42.dll invalid page fault problem with both WinOnCD 5.0 versions. My German version is updated to the present with Roxio.de service packs; the USA version is already updated, and there are no service packs yet available for it from the CeQuadrat USA website. Did I mention I LOVE WinOnCD? I check both Roxio's German website and the new CeQuadrat USA website for updates at least weekly. 

Do you think I might be having a conflict between WinOnCD 5.0 and those elements of WinOnCD 3.8 that haven't been removed from my system by the "add/remove programs" utility? I'm not sure how many elements are left behind after an uninstall, but I do know I still have Roxio entries in the registry (there should only be CeQuadrat entries for the USA version), and I still have a number of old Roxio files in C:\Windows\Temp. A large number, as I guess another Roxio "Windows Installer Package" is left there after every install.......and I've deleted/installed all three of my WinOnCD versions a LOT!

Is there any way to completely eradicate a program like WinOnCD from one's system? I'm wondering if my solution might lay in starting afresh.


----------



## Rollin' Rog (Dec 9, 2000)

It's quite possible.

You might try a registry cleaner after an uninstall. Although these are not without some risks to use, most of the problems I have seen with them have occured on WinME or XP systems, not Win98.

I post JV's "comparison" page here, because he has two versions, one the "original" RegCleaner and the other incorporated into his Power Tools (haven't used this one myself). The Power Tools version appears to be much more aggressive:

http://www.vtoy.fi/jv16/shtml/registry_test.shtml

These tools will have a backup feature, be sure to know how to use it if problems arise. You also have Windows scanreg /restore, but you would not want to restore immediately after an uninstall unless you had backed up the current registry first, as Windows will only backup the registry on the first boot of the day unless you do it manually (run: scanreg)


----------



## gyrate (Jul 1, 2001)

AAARRRRGGGGHHHH!

In the link you just sent me, Rollin'Rog, one of the most aggressive (yet safe/accurate) registry cleaners tested was one called "RegSeeker". I uninstalled WinOnCD, leaving my computer with NO burning programs installed. Then I ran RegSeeker, making sure I did a backup, and RegSeeker found 170 problems. I had RegSeeker delete the problems, and........OOPS! My Roxio, CeQuadrat, and Ahead entries are still in my registry. No programs, mind you, but lotsa registry keys.

How safe would it be for me to manually delete all Roxio, CeQuadrat, and Ahead keys in my registry? All the programs are gone; if I want to reinstall, won't the installer also install all needed registry keys?

And then there's the real question: Would I potentially gain anything by deleting these registry keys?


----------



## Rollin' Rog (Dec 9, 2000)

Well, I was trying to point you to JV's Power Tools; you could try that as well.

It's pretty safe to delete the keys for uninstalled programs if you know you are just deleting those and they are not shared by others.

Your ARRhhh!, scared the heck out of me, I thought you had screwed the pooch completely 

Remember you can Export (save) first any key you delete and restore them manually. Or you can manually backup the whole registry and restore that if problems develop.


----------



## gyrate (Jul 1, 2001)

Sorry about the "AARRGGHH!!". I was simply expressing the joy I felt at the delightful tenacity of these %$#&% registry keys!  

Would you mind describing for me the process of exporting, then reinstating, a registry key? Particularly the reinstating part. Is it a simple matter of copy and paste? Is the process the same for the entire registry?

What the heck! I'll try JV's Power tools, too! And then I'll go into the registry and manually remove any remaining Roxio/ CeQuadrat/Ahead keys, as there are no programs by any of these companies on my machine. Then I'll try a reinstall of WinOnCD, and see what happens!

Rollin'Rog......please know I greatly appreciate your patience and willingness to share your knowledge! Whatever else happens, I am growing much more confident and knowledgeable with my computer. Thanks!


----------



## Rollin' Rog (Dec 9, 2000)

Before you delete an individual key (select or highlight it first), click Registry > Export. Name the key and save (export) it to a convenient folder. To restore that particular key all you have to do is 'run' it; you will be prompted to merge it back to the registry.

You can, if you want, export the whole registry (don't select or highlight anything, have the 'tree' completely collapsed); this works when you are deleting keys as the merge will replace them. It does not work to restore a registry this way to which things have been added, since a 'merge' leaves what is already there.

To do a total restore, you must run scanreg /restore from a true DOS prompt (not Windows). You get the last 4 days as options. A new one is created each first boot of the day. You can also run scanreg /backup to manually create one, but my experience has found these to occasionally fail to restore.

[ To confuse you further...You also can copy to a protected folder a registry that has been previously archived and save it long term. Registry backups are kept in the directory c:\windows\sysbckup

They have names like rbnn.cab -- where the nn is a number. If you copy them back, they will reappear when you run scanreg /restore]

For your present purposes, it is probably easiest just to use the Registry Editor to Export before you delete.

You're welcome for the help, like you I just keep plugging along 

I just should add that if you should do something that makes Windows unbootable >> press the ctrl key starting up to get to the Startup Menu. Select the Command Prompt and at the c:> prompt enter:

scanreg /restore


----------



## gyrate (Jul 1, 2001)

Whoa!!!! Did WinOnCD "disc copy" just open flawlessly THREE consecutive times for me? Something is very definitely different now, Rollin' Rog, different and BETTER!!!!

JV's Power tools comprise a wonderful utility array......thank you for introducing me to them! Cleaning outdated keys from the registry was a snap. So was cleaning out old unused files and software. 

The only element of dissatisfaction I still have is that I'm not certain what caused my problem in the first place.......or what I did that appeared to fix it.

Nonetheless, it does seem to be fixed. And I find myself armed with more computer knowledge than I've ever had before, and with some very potent new utilities to keep my system "lean and mean". Thank you again, Rollin'Rog, for some VERY good help!


----------



## gyrate (Jul 1, 2001)

Sorry.......where I do owe you my thanks, I also owe you a description of the actions that seemed to clear up my problem:

First, I uninstalled ALL burning programs from my computer. These included WinOnCD 5.05b (USA version) and Nero 5.5 (updated with downloads as late as three days ago). The WinOnCD program had been updated with Roxio (Germany) Unidriver 1.18.01.

Then I ran JV's Power Tools, cleaning my registry of all Ahead, CeQuadrat, and Roxio entries. I also removed all files, folders, and software from those three sources. And.......I couldn't resist deleting that friggin' "Creative News Update" key/program you told me about. I was able to accomplish everything without ever going into Regedit.......JV's Power Tools did it all! 

I rebooted my computer, then reinstalled WinOnCD 5.05b and the (Roxio.de) Unidriver 1.18.01. And I tried running "disc copy".

AND IT WORKS!!!!!!


----------



## Rollin' Rog (Dec 9, 2000)

Outstanding.  

JV's a winner all right. I'm not sure how old he is now, but when he first offered 'RegCleaner' a few years ago, I think he was only 16! The Power Tools were a successor after a year or two, and have probably won more fans than any others I know of.

As I mentioned though, I do see an occasional problem from time to time on XP/ME systems, usually involving Help Center entries.

You're most welcome for the help!


----------

