# small prob



## shoomyd (Apr 6, 2003)

i'm using win98 se

recently i had the parite b virus but i dont know if it has something to do with my problem

anyways

when i start certain programs like IE and icq for example (all exe)
i get error message thats it preformed an ilegal operation
the details are

IEXPLORE caused an invalid page fault in
module KERNEL32.DLL at 017f:bff83ba3.

and a bunch of registers

then i get another error

This operation has been cancelled due to restrictions in effect on this computer. please contact your system administrator

I dont have system admin, this is my machine

I believe its some restriction in registry
plz help me.


----------



## walkeriam (Feb 19, 2002)

Try going to ADD and REMOVE Programs in the CONTROL PANEL and click on INTERNET EXPLORER then REMOVE. A window should pop up that will allow you to click REPAIR Internet Explorer.


----------



## shoomyd (Apr 6, 2003)

No no
i said its much more than IE
its icq, its msxml
and so and so


----------



## TonyKlein (Aug 26, 2001)

We'd like to have a closer look at your configuration.

Please do this:

Go to http://www.spywareinfo.com/downloads.php#det, and download 'Hijack This!'.

Unzip it, launch Hijack This, then press "Config" > "Miscellaneous Tools", and press "Generate Startuplist Log"

This will generate a text file that will list all running processes, _all_ applications that are loaded automatically when you start Windows, and more.

Go to Edit > select all, copy it and post its contents here.


----------



## walkeriam (Feb 19, 2002)

You can try going to START, PROGRAMS, ACCESSORIES, SYSTEM TOOLS and click on SYSTEM INFORMATION. Click on TOOLS at the top and then SYSTEM FILE CHECKER. Select SCAN FOR ALTERED FILES and click START. This will scan for bad files and alert you if it finds any. It may ask you to put in the WINDOWS 98 CD, so it can recover/reinstall a missing file. Or you can do what Tony said.


----------



## shoomyd (Apr 6, 2003)

StartupList report, 06/04/03, 23:18:35
StartupList version: 1.40.1
Started from : C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE
Detected: Windows 98 SE (Win9x 4.10.2222A)
Detected: Internet Explorer v6.00 (6.00.2600.0000)
* Using default options
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\COMMON FILES\SERVICES\WSSDSU.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\TASKMON.EXE
C:\PROGRAM FILES\A4TECH\MOUSE\AMOUMAIN.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\PROTECTOR PLUS\PPTBC.EXE
C:\PROGRAM FILES\PROTECTOR PLUS\PPINUPDT.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\MEDIAKEY\VERSATO.EXE
C:\PROGRAM FILES\MEDIAKEY\MEPLAYER.EXE
C:\PROGRAM FILES\MEDIAKEY\OSD.EXE
C:\PROGRAM FILES\MEDIAKEY\MAILCHK.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\MIRC\MIRC.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\PROTECTOR PLUS\PPVSTOP.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\WINDOWS\Start Menu\Programs\StartUp]
Versato.lnk = C:\Program Files\MediaKey\Versato.exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

internat.exe = internat.exe
SystemTray = SysTray.Exe
ScanRegistry = C:\WINDOWS\scanregw.exe /autorun
TaskMonitor = C:\WINDOWS\taskmon.exe
WheelMouse = C:\PROGRA~1\A4TECH\MOUSE\AMOUMAIN.EXE
StillImageMonitor = C:\WINDOWS\SYSTEM\STIMON.EXE
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
PP2000 Taskbar Control = C:\PROGRA~1\PROTEC~1\PPTbc.EXE
PP2000 Real-time Scan = C:\PROGRA~1\PROTEC~1\PPVstop.exe
PP2000 InstaUpdate = C:\PROGRA~1\PROTEC~1\PPInupdt.exe
TkBellExe = "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
SchedulingAgent = C:\WINDOWS\SYSTEM\mstask.exe
Serv-U = C:\PROGRAM FILES\COMMON FILES\SERVICES\WSSDSU.EXE

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

msysdemo = C:\Program Files\msysdemo\msysdemo.exe

--------------------------------------------------

Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = rundll32.exe advpack.dll,UserInstStubWrapper {89820200-ECBD-11cf-8B85-00AA005B4383}

[>PerUser_MSN_Clean] *
StubPath = C:\WINDOWS\msnmgsr1.exe

[PerUser_LinkBar_URLs] *
StubPath = C:\WINDOWS\COMMAND\sulfnbk.exe /L

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = "C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:IE50 /user /install

[{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}] *
StubPath = C:\WINDOWS\SYSTEM\updcrl.exe -e -u C:\WINDOWS\SYSTEM\verisignpub1.crl

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
StubPath = "C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:OE /CALLER:IE50 /user /uninstall

--------------------------------------------------

Load/Run keys from C:\WINDOWS\WIN.INI:

load=
run=

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=Explorer.exe
SCRNSAVE.EXE=
drivers=mmsystem.dll power.drv

--------------------------------------------------

Checking for EXPLORER.EXE instances:

C:\WINDOWS\Explorer.exe: PRESENT!

C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present

--------------------------------------------------

C:\AUTOEXEC.BAT listing:

CD C:\PROGRA~1\SHO
SET CLASSPATH="C:\WINDOWS\SYSTEM\QTJava.zip"
SET QTJAVA="C:\WINDOWS\SYSTEM\QTJava.zip"
mode con codepage prepare=((862) C:\WINDOWS\COMMAND\hebega.cpi)
mode con codepage select=862
REM Protector_Plus_AntiVirus
path=%path%;C:\PROGRA~1\PROTEC~1

--------------------------------------------------

C:\CONFIG.SYS listing:

device=C:\WINDOWS\COMMAND\display.sys con=(ega,,1)
Country=972,862,C:\WINDOWS\COMMAND\country.sys

--------------------------------------------------

Checking for superhidden extensions:

.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX (file missing) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\PROGRAM FILES\SUPERBAR\SUPERBAR.DLL (file missing) - {136A9D1D-1F4B-43D4-8359-6F2382449255}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Tune-up Application Start.job
Maintenance-Defragment programs.job
Maintenance-ScanDisk.job
Maintenance-Disk cleanup.job

--------------------------------------------------

Enumerating Download Program Files:

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\DIRECTOR\SWDIR.DLL
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

[Loader Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\MACONNECT.DLL
CODEBASE = http://connect.online-dialer.com/MaConnect.cab

--------------------------------------------------

Enumerating Winsock LSP files:

Protocol #1: C:\WINDOWS\SYSTEM\DRWHOOK.DLL
Protocol #2: C:\WINDOWS\SYSTEM\DRWHOOK.DLL
Protocol #3: C:\WINDOWS\SYSTEM\DRWHOOK.DLL
Protocol #4: C:\WINDOWS\SYSTEM\DRWHOOK.DLL
Protocol #5: C:\WINDOWS\SYSTEM\DRWHOOK.DLL
Protocol #6: C:\WINDOWS\SYSTEM\DRWHOOK.DLL
Protocol #13: C:\WINDOWS\SYSTEM\DRWHOOK.DLL

--------------------------------------------------
End of report, 7,424 bytes
Report generated in 0.371 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only


----------



## TonyKlein (Aug 26, 2001)

I feel I should warn you that SFC is just a dumb application. It doesn't "know" anything, it just compares.

It lists differences between the last time you ran it and now, and if that last time is long ago, the results will be very hard to interpret.
One example: if between those times you uninstalled some software, SFC will holler: "there are files missing!"

Of course there are: you probably uninstalled some software in the meantime, but SFC doesn't know that.

Also, SFC is often very unclear in how it reports matters, and it makes mistakes as well.

Take a look here:

System File Checker Tool Extracts Incorrect File Versions

Error Message: System File Checker Identified that the Following File may Be Corrupted. File: EXTRAC32.EXE...

If you want to run it, run it regularly, so that the changes will mean something to you, if they make sense at all.


----------



## shoomyd (Apr 6, 2003)

again.

I
DONT
CARE
ABOUT
IE

plz read my first msg there u will see the error, and that it messed up alot more than ie, ie was just an example


----------



## TonyKlein (Aug 26, 2001)

OK, the following startups belong to a virus, worm or trojan:

- Serv-U = C:\PROGRAM FILES\COMMON FILES\SERVICES\WSSDSU.EXE

- msysdemo = C:\Program Files\msysdemo\msysdemo.exe

And you have a dialer.

You should start by running an online scan at Trend Micro HouseCall

When you're done, re-run Hijack This, but this time hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log" button.
Press that, save the log somewhere, and please show us its contents.

HT will allow us to remove some of this stuff quite comfortably.


----------



## shoomyd (Apr 6, 2003)

my bad
pressed fix

but i still got some errors
Logfile of HijackThis v1.81.0
Scan saved at 23:49:33, on 06/04/03
Platform: Windows 9x 4.10.2222
MSIE version: 6.0.2600.0000

O9 - Extra button: Related
O9 - Extra 'Tools' menuitem: Show &Related Links
O10 - Unknown file in Winsock LSP: C:\WINDOWS\SYSTEM\DRWHOOK.DLL
O10 - Unknown file in Winsock LSP: C:\WINDOWS\SYSTEM\DRWHOOK.DLL
O10 - Unknown file in Winsock LSP: C:\WINDOWS\SYSTEM\DRWHOOK.DLL
O10 - Unknown file in Winsock LSP: C:\WINDOWS\SYSTEM\DRWHOOK.DLL
O10 - Unknown file in Winsock LSP: C:\WINDOWS\SYSTEM\DRWHOOK.DLL
O10 - Unknown file in Winsock LSP: C:\WINDOWS\SYSTEM\DRWHOOK.DLL
O10 - Unknown file in Winsock LSP: C:\WINDOWS\SYSTEM\DRWHOOK.DLL
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003031901/housecall.antivirus.com/housecall/xscan53.cab


----------



## TonyKlein (Aug 26, 2001)

> _Originally posted by shoomyd:_
> *my bad
> pressed fix
> 
> *


*

That's not good. You deleted some important stuff... 

You need to restore it: launch Hijack This, press Config > Backups, and check and restore all.

Subsequently reboot, run Hijack This again, and post a fresh log.*


----------



## shoomyd (Apr 6, 2003)

Logfile of HijackThis v1.81.0
Scan saved at 00:10:59, on 07/04/03
Platform: Windows 9x 4.10.2222
MSIE version: 6.0.2600.0000

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL=http://216.65.101.250/sbms/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar=http://216.65.101.250/sbms/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page=http://216.65.101.250/sbms/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant=http://216.65.101.250/sbms/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch=http://adipics.com/
O1 - Hosts: 66.40.16.218 auto.search.msn.com
O1 - Hosts: 66.40.16.218 auto.search.msn.com
O1 - Hosts: 66.40.16.218 auto.search.msn.com
O1 - Hosts: 127.0.0.1 rmads.eu.msn.com
O1 - Hosts: 66.40.16.218 auto.search.msn.com
O1 - Hosts: 66.40.16.218 auto.search.msn.com
O1 - Hosts: 66.40.16.218 auto.search.msn.com
O1 - Hosts: 127.0.0.1 ads.eu.msn.com
O1 - Hosts: 127.0.0.1 ads.ninemsn.com.au
O1 - Hosts: 127.0.0.1 ads.msn.com
O1 - Hosts: 66.40.16.218 auto.search.msn.com
O1 - Hosts: 66.40.16.218 auto.search.msn.com
O1 - Hosts: 66.40.16.218 auto.search.msn.com
O1 - Hosts: 127.0.0.1 adevents.msn.com
O2 - BHO: (no name) - {136A9D1D-1F4B-43D4-8359-6F2382449255} - C:\PROGRAM FILES\SUPERBAR\SUPERBAR.DLL (file missing) (file missing)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX (file missing) (file missing)
O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\A4TECH\MOUSE\AMOUMAIN.EXE
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PP2000 Real-time Scan] C:\PROGRA~1\PROTEC~1\PPVstop.exe
O4 - HKLM\..\Run: [PP2000 Taskbar Control] C:\PROGRA~1\PROTEC~1\PPTbc.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PP2000 InstaUpdate] C:\PROGRA~1\PROTEC~1\PPInupdt.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [Serv-U] C:\PROGRAM FILES\COMMON FILES\SERVICES\WSSDSU.EXE
O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - HKCU\..\Run: [msysdemo] C:\Program Files\msysdemo\msysdemo.exe
O8 - Extra context menu item: Allow Popups - C:\Program Files\Meaya\Popup Ad Filter\WhiteGetUrl.js
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE10\EXCEL.EXE/3000
O9 - Extra button: Related
O9 - Extra 'Tools' menuitem: Show &Related Links
O9 - Extra button: ICQ Lite
O9 - Extra 'Tools' menuitem: ICQ Lite
O9 - Extra button: ICQ
O9 - Extra 'Tools' menuitem: ICQ
O10 - Unknown file in Winsock LSP: C:\WINDOWS\SYSTEM\DRWHOOK.DLL
O10 - Unknown file in Winsock LSP: C:\WINDOWS\SYSTEM\DRWHOOK.DLL
O10 - Unknown file in Winsock LSP: C:\WINDOWS\SYSTEM\DRWHOOK.DLL
O10 - Unknown file in Winsock LSP: C:\WINDOWS\SYSTEM\DRWHOOK.DLL
O10 - Unknown file in Winsock LSP: C:\WINDOWS\SYSTEM\DRWHOOK.DLL
O10 - Unknown file in Winsock LSP: C:\WINDOWS\SYSTEM\DRWHOOK.DLL
O10 - Unknown file in Winsock LSP: C:\WINDOWS\SYSTEM\DRWHOOK.DLL
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003031901/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {02C20140-76F8-4763-83D5-B660107B7A90} (Loader Class) - http://connect.online-dialer.com/MaConnect.cab


----------



## TonyKlein (Aug 26, 2001)

Wow, that's quite some thrash you have there...

Run Hijack This, and check ALL of the items in bold. Doublecheck so as to be sure not to miss a single one.
Next, shut down _all_ Internet Explorer Windows, and have HT fix all checked.

Reboot when you're done.

*R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL=http://216.65.101.250/sbms/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar=http://216.65.101.250/sbms/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page=http://216.65.101.250/sbms/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant=http://216.65.101.250/sbms/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch=http://adipics.com/
O1 - Hosts: 66.40.16.218 auto.search.msn.com
O1 - Hosts: 66.40.16.218 auto.search.msn.com
O1 - Hosts: 66.40.16.218 auto.search.msn.com
O1 - Hosts: 127.0.0.1 rmads.eu.msn.com
O1 - Hosts: 66.40.16.218 auto.search.msn.com
O1 - Hosts: 66.40.16.218 auto.search.msn.com
O1 - Hosts: 66.40.16.218 auto.search.msn.com
O1 - Hosts: 127.0.0.1 ads.eu.msn.com
O1 - Hosts: 127.0.0.1 ads.ninemsn.com.au
O1 - Hosts: 127.0.0.1 ads.msn.com
O1 - Hosts: 66.40.16.218 auto.search.msn.com
O1 - Hosts: 66.40.16.218 auto.search.msn.com
O1 - Hosts: 66.40.16.218 auto.search.msn.com
O1 - Hosts: 127.0.0.1 adevents.msn.com

O2 - BHO: (no name) - {136A9D1D-1F4B-43D4-8359-6F2382449255} - C:\PROGRAM FILES\SUPERBAR\SUPERBAR.DLL (file missing) (file missing)

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\RunServices: [Serv-U] C:\PROGRAM FILES\COMMON FILES\SERVICES\WSSDSU.EXE
O4 - HKCU\..\Run: [msysdemo] C:\Program Files\msysdemo\msysdemo.exe

O16 - DPF: {02C20140-76F8-4763-83D5-B660107B7A90} (Loader Class) - http://connect.online-dialer.com/MaConnect.cab*

After rebooting, go to your :\Program files\common files\services folder, and delete the following files (not all of them may be there):

Serv-U.ini 
slog.sys 
wssdsu.exe 
wssdsup.exe 
wssdtu.exe 
wsys.dll 
wsys.exe

Next, delete the entire *msysdemo* folder in Program Files.

Finally, download and run this Winsock2 fix: http://digital-solutions.co.uk/lavasoft/whndnfix.zip

Keep us posted on your progress!


----------



## shoomyd (Apr 6, 2003)

done it all
and still my original problem stays


----------



## TonyKlein (Aug 26, 2001)

Try this quick and dirty fix to remove most restrictions:

Download the attached Remove.txt, and save as (rename to) Remove._reg_ (save as 'all files') .

Doubleclick Remove.reg, and answer 'yes' when asked whether you'd like its contents added to the Registry.

Reboot when you're done.

Tell us whether that helps


----------



## shoomyd (Apr 6, 2003)

nope:\
didn't help:\


----------



## TonyKlein (Aug 26, 2001)

I'm running out of ideas pretty fast here.... 

I'd like you to run an online scan at Trend Micro HouseCall

Let's see whether that turns up anything.


----------



## Mosaic1 (Aug 17, 2001)

Are you using a different machine at the moment? If not, please explain a little more clearly exactly what is going on. 
You say you get an error each time you try to start an exe. All exe's or only Internet Related exe's? The more precise the information you give, the more help we can give you.

Try this. Download the exefix08 and copy it to floppy. Take it to the problem machine and run it.

Here's the link to the download:

http://home.earthlink.net/~rmbox/Reticulated/Toys.html


----------



## shoomyd (Apr 6, 2003)

tony - ran it already found nothing

mosaic - 

not all exe...but not just internet related
and i'm using the messed up machine
i can't activate IE directly threw its exe
i run it threw favorites(html docs)


----------



## Mosaic1 (Aug 17, 2001)

Someone suggested earlier that you run the IE repair tool. Did you do that? If not, you should. See what the results are for that. If it tells you IE cannot be repaired, click Details and post those, please.

Many other programs rely on IE files to function.


----------



## shoomyd (Apr 6, 2003)

AGAIN
I DONT CARE ABOUT THE IE
IE IS NOT MY PROBLEM
THE RESTRICTIONS ARE
THEY DONT JUST RESTRICT THE IE
THEY RESTRICT THE IE *IN ADDITION* TO THINGS I DO CARE ABOUT
IE IS SECONDARY
WAS ONLY AN EXAMPLE

PLZ STOP TRYING TO FIX ONLY THAT


----------



## walkeriam (Feb 19, 2002)

Read Mosaic1's Last Post!!! IT MAY HELP YOUR OTHER PROBLEMS, it sure won't hurt.


----------



## shoomyd (Apr 6, 2003)

ie is not the source of the problem.
THAT I KNOW

but if u must know
i cant uninstall cause its not in the add/remove from some reason
i cant reinstall it
cause the installion makes the same errors that i talked about in the first message


----------



## AlwaysLearning (Dec 8, 1999)

The first error message is usually video driver related(the memory address referenced does point to video)-do you have the newest drivers? You can also try turning down hardware acceleration.
As to the second problem, I don't think its related to the first????Do you use poledit(system policy editor) or anything similar? You could do a complete search in regedit for "restrictions" and see what returns.

Good luck


----------



## shoomyd (Apr 6, 2003)

first error is related to second

tryed poledit and searching for restrictions
but found nothing


----------



## walkeriam (Feb 19, 2002)

If you can get the bad computer to connect to the internet, go here:

http://www.microsoft.com/windows/ie/downloads/critical/ie6sp1/default.asp

and Download and Install a new Internet Explorer 6 and service pack 1.
You have nothing to lose but your time.


----------



## AlwaysLearning (Dec 8, 1999)

Video drivers? You did'nt say.


I guess I need to be enlightened.  How is the first error related to the second?


----------



## Mosaic1 (Aug 17, 2001)

shoomyd ,

Part of troubleshooting Windows is making sure IE is running correctly. I don't know for sure what the problem is here, but it is a start. Checked your VM lately? DirectX? A start is just that. A start. There's a lot of work to be done. 

I have had a long day and do not enjoy being shouted at. Good luck with your problems. I choose not to pursure this any further.

Also, don't ever reject a constructive suggestion out of hand. You are not a programmer are you? Do you really know the inner workings of the Operating System? I wonder if even Bill Gates does. It is very complex. 

LOL

Mo

P.S. Examples are not good enough. We need all information. If you don't supply it, nobody can help.


----------



## shoomyd (Apr 6, 2003)

i did not shout at any body
i am sorry if you took it that way

the problem
is a restriction in the registry
not ie
but i cant find where in the registry


----------



## TonyKlein (Aug 26, 2001)

> _Originally posted by shoomyd:_
> *ithe problem
> is a restriction in the registry
> not ie
> *


You don't know that for sure.

As Mosaic1 just explained, many other programs rely on IE files to function, so we need to be sure everything is all right in that department.

We need make sure we're not skipping any steps. That is, if you want us to help you try get rid of your problem.

I'd like you to upgrade to IE 6.0 SP1. That will update a great number of shared system files.

Also download Exefix.com from this site: http://home.earthlink.net/~rmbox/Reticulated/Only_IE.html

Doubleclick it, and it will restore the default Windows file associations for exefiles.

Please do that, and report on your progress.


----------



## Rollin' Rog (Dec 9, 2000)

So all these "restriction" problems regarding exe's just have to do with internet related programs?

In addition to doing what Tony suggested, please do the following also.

Do a Find Files for *hosts* and rename the hosts file *ghosts*. Ignore hosts.sam or lmhosts.sam, you just want to rename the one that has no extension.

Also go to Internet Options > Programs and click on the "reset web settings" tab. If you have more than one browser, test the issue with the other browser.

Most exe related shell open problems and restrictions that affect other exes do not usually affect Internet Explorer, so you have some kind of Internet related issue here which is why the focus has been on IE.

Try this test as well: run *msconfig* and uncheck the option to load the startup group processes on the General Page. Then test to see whether the problem continues. If it doesn't, then there is some program under the startup group tab causing the issue. You can re-enable the group if the issue persists.

Have you run the IE Repair tool as suggested? Add/Remove programs > IE > Remove > Repair.

Finally, you may have a corrupt wsock32.dll as similar errors were associated with the old Happy99 worm.

http://support.microsoft.com/?kbid=221486

Follow the instructions to replace it here:

http://www.claymania.com/wsock32-extraction.html

You may need to restart in Safe Mode to successfully do this using sfc

Using SFC to extract files

1. Go to Start>Run and enter SFC and click OK
2. Check "Extract one File"
3. Enter the file name and click on "Start"
4. In the "Restore from" field enter:: *D:\WIN98* [if 'D' is not the letter of your CD-Rom drive, modify appropriately]
5. Click OK

{if you do not have a Windows system CD, try subsitituting *c:\windows\options\cabs* in the"restore from field"}


----------



## shoomyd (Apr 6, 2003)

thanks everyone who tryed to help 

i will try to fix my problem somewhere else


----------



## TonyKlein (Aug 26, 2001)

So tell us what exactly you object to at this board:

The great level of expertise? The helpfulness? The doggedness with which people here try to help you solve a problem?

LOL!


----------



## Mosaic1 (Aug 17, 2001)

shoomyd,

Sorry you feel you need to go elsewhere. But you will not fix your problems until you replace the files which have been rewritten. Anything which doesn't work may have code altered by the virus. The cause of the restrictions message may not be in the registry at all. I did a little reading on this one and it seems it rewrites code. Click on a particular exe and you do not get the expected result. Nothing I read indicates that it has rewritten the code to bring up a restrictions message box, but it might have. 

There are only certain areas of the Registry which hold actual instructions to enforce a restriction. If you have looked there and found nothing then this may be a trick written by the virus. When the usual doesn't work, look for the unusual. I don't know. Have a look at Tony's file. The attachment which removed the retrictions keys. Use it. Then click on one of those exe files which brings up the restrictions message. If it brings up the message again, go to the registry and look at each key Tony had you remove. If it's in there, the altered exe somehow put it there. If not, then the code to bring up a message box is in the exe file. 


Again, I urge you to upgrade IE to get new Files. And for any other programs not working, do a complete uninstall. Be sure the executable has been removed. Do a clean reinstall of that particular program.


Here's what McAffee says about this virus:
This is an encrypted parasitic file-infecting virus and network aware worm. It appends PE EXE and SCR files in the Windows directory and subdirectories on the local system, as well as on any accessible network share. The virus creates an additional PE section with a random 3 letter section header followed by the character "". 

The virus creates the following registry key: 
HKEY_CURRENT_USER\Software\Microsoft\Windows\ 
CurrentVersion\Explorer\PINF 

You didn't indicate whether or not you had tried any of the suggestions given you by the others here. For one, Rog is the best. Tony's great. He has an incredoible reputation in the Security community. etc etc. I am a slug. LOL 

If you choose to ignore well thought out advice you may end up with a format and reinstall instead of a replacement of altered files. 

It takes time and patience to fix computers. 

Mo


----------



## Rollin' Rog (Dec 9, 2000)

Lol, I'll defer to Tony as chief of Security, I've gotten too lazy


----------



## shoomyd (Apr 6, 2003)

to tony- i dont object to anything in this forum....

and to mosaic
i tryed everything...
of course reinstalling works

but!
when i try to install msxml 4.0
the restriction stops me
doesn't matter that i just downloaded the installation


----------



## Mosaic1 (Aug 17, 2001)

Rog,

OK Tony is KING! LOL You Lazy? I doubt it.

shoomyd,



> i tryed everything...
> of course reinstalling works


 I am not sure what this means. Does it mean you have reinstalled the problem apps and they now work? When an exe is damaged, the only way to repair the app is to replace the exe.

For the msxml. Is there an uninstall for the previous version available? Was it an upgrade, a preview version? Did you reinstall IE? If so, did you uninstall and reboot before trying a new install? Which version IE and msxml 
did / do you have installed? An upgrade to what IE installs? msxml 4.0 is. 
Everything is so connected in Windows. That's what integrated means. Please, a one sentence answer is not enough.


----------



## shoomyd (Apr 6, 2003)

reinstalled IE
works perfectly just like u guys said,
but like i said, i dont care about IE and it didn't fix anything else
so, we can forget about IE forever

i downloaded msxml 4.0 installation 
and the error i mentioned in the first post occoured


----------



## Mosaic1 (Aug 17, 2001)

You had originally said you had other programs not working as well as IE.



> but like i said, i dont care about IE and it didn't fix anything else
> so, we can forget about IE forever


Lose the attitude. No IE and no windows among other things. IE provides support files which other apps use to run. And you did have a problem with IE.

I asked you if any other applications you had problems with had been reinstalled and are now working. I asked you to run Tony's atachment again.... is there an uninstall for the previous upgrade to msxml you had installed and did you run it?

Is this the case? Is msxml 4.0 installation the only problem now? I am not going to continue to type the same questions over and over. We are all volunteers here. We do it to help.

I need answers to the questions as I have repeatedly asked. Otherwise, I am not going to continue trying to pull teeth with you.


----------



## shoomyd (Apr 6, 2003)

i have no attitude

and as you said, all the answers:
ICQ is also working now after reinstall

ran tony's atachment
it said:
======================================================= 
EXEfix08 for Windows 95/98 - Freeware by rmbox 
======================================================= 

Program Report: 

Complete "EXE" Input Entered at 10/04/2003 21:00:35.37 

The correct "EXE" Registry Data has been restored.
All programs with the "EXE" extension should operate 
normally now. 

Please test one of your programs to confirm this. 


Additional Information: 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 

NO TANGIBLE PROBLEMS WERE ENCOUNTERED... 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
but it didn't help, ran msxml installation to check it and still
the hated error occoured

i dont know about any other msxml i have so i dont know about upgrades for them

and no, i am 100% sure beyond any doubt that there are other problem
if you like i'll look for them


----------



## bandit429 (Feb 12, 2002)

There is a link below that i thought might be worth a look. It refers to damaged passwords,,I guess that could apply.

http://support.microsoft.com/?kbid=187965


----------



## shoomyd (Apr 6, 2003)

nope

but thanks anyways


----------



## bandit429 (Feb 12, 2002)

nope what???


----------



## Mosaic1 (Aug 17, 2001)

Not Tony's link. His attachment. If you'll go back to Post # 15 in this thread and read the instructions and run the file again to remove all restrictions, please. 

The attachment is named Remove.txt

Rename it Remove.reg
Double click on Remove.reg 
Reboot. 
Try the install again. 



Please try running any and all programs to see if they are OK.


----------



## shoomyd (Apr 6, 2003)

done.

didn't help


----------



## shoomyd (Apr 6, 2003)

when i press right click in IE to save something
i use to have an option: download with getright
its gone

how do i bring it back?


----------



## ~Candy~ (Jan 27, 2001)

Did you delete that program? Or perhaps run spybot or something similar?

http://www.getright.com/get.html


----------



## bandit429 (Feb 12, 2002)

shoomyd 
I think you should have posted that in the thread where you said you don't care about I E,,Seems you do now.

http://forums.techguy.org/showthread.php?s=&threadid=127519


----------



## ~Candy~ (Jan 27, 2001)

Merging threads since they more than likely are releated......


----------



## shoomyd (Apr 6, 2003)

plz unmerge
they are two diffrent worlds.

and to bandit
its still far far down the list of things that i care about


----------



## ChickaD (Apr 11, 2003)

I am new to TSG, as in just registered last night! I am very excited to see how you have tried to help this one individual, in spite of very little encouragement at times. It shows me you truly care and enjoy the challenge of trying to help someone in this less-than-perfect and VERY tedious medium of typing messages--on the part of all. I have a friend who wants me to ask about a couple of problems she is having. But I need to find out her versions of OE and IE first, so I will have given the responders as much help as possible. I am looking forward to using your combined expertise!


----------



## bandit429 (Feb 12, 2002)

Yeah well sometimes we get the tough customers  Welcome to TSG I'll be looking forward to your posts,,as I am sure we all will be.  Thank you for the compliments, that was a very nice thing to say!


----------



## shoomyd (Apr 6, 2003)

and i again i must ask to unmerge my topics plz.


----------



## ~Candy~ (Jan 27, 2001)

> _Originally posted by shoomyd:_
> *plz unmerge
> they are two diffrent worlds.
> *


The problem still is relating to IE..........there is no reason to unmerge.....but thanks for the suggestion


----------



## shoomyd (Apr 6, 2003)

oh my god
is this intented to make me mad?
your ie obsession i mean?

i said
TWO
DIFFRENT 
PROBLEMS

north and south
hell and heaven
black and white

forget it.
doesn't matter anymore.


----------



## AlwaysLearning (Dec 8, 1999)

Good luck at the forum where the people looking for answers,have all the answers. 


done


----------



## TOGG (Apr 2, 2002)

Though it is probably not going to impress, or assist shoomyd, I would be grateful if one of you really knowledgable people would spell out the Internet/Windows Explorer relationship in simple terms.

My understanding is that IE and Windows Explorer are just alternative interfaces for the same program and, since Explorer must always be running if your computer is to work, it is, to all intents and purposes, your OS.


----------



## walkeriam (Feb 19, 2002)

The difference between Windows Explorer and Internet Explorer is: Windows Explorer is a FILE MANAGEMENT TOOL and Internet Explorer is a WEB BROWSER. Each program is capable of displaying both local resources (disk and files) and remote resources (web pages on an intranet or internet). Internet Explorer is useful for quick views of local folders and for simple file maintenance chores and Windows Explorer offers a more comprehensive and easily navigated view of your computer, and it also offers more file management tools. Hope this helps your understanding.


----------

