re: Multiple illegal operation errors on startup
Wednesday, May 18, 2005 at 10:40 am
Windows 98 Annoyances Discussion Forum
Posted by Ms. Eagle
(33507 messages posted)
Hi there,
Yes, it's likely the infection is at causing the illegal operation messages. You
didn't say, whether you ran the online virus scan I suggested? If not, please do
so after fixing these entries and deleting the infected files. Please follow these
instructions carefully.
You'll need to make sure hidden files are visible:
How to Show System Files
Boot into Safe mode to fix these entries:
Starting your computer in Safe mode
You need to make sure Trojan Hunter, and any other prevention programs, aren't running
to hinder removal. You could disable them temporarily by removing them from startup.
Once in Safe mode, close ALL open windows. Run HJT, select these entries. Choose
Fix checked. Close HJT.
C:\WINDOWS\PTSNOOP.EXE
F1 - win.ini: load=C:\WINDOWS\PTSNOOP.EXE
O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll
(file missing)
O4 - HKLM\..\Run: [ATIGART] c:\ati\gart\atigart.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
O4 - HKLM\..\Run: [IST Service] \ISTsvc\istsvc.exe
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a}
- C:\WINDOWS\web\related.htm
Locate and delete these files:
C:\WINDOWS\PTSNOOP.EXE <--
C:\WINDOWS\isrvs\desktop.exe <--
C:\WINDOWS\isrvs\ffisearch.exe <--
Run a search for this one, using Find - Files or folders. The log shows no path to
it. If found, delete it.
istsvc.exe
Important: Before rebooting, clear your browser cache. For IE: Go into the Control
Panel - Internet Options - General tab. Delete temporary internet files - choose
'delete all Offline content'. Settings - set the size of your TIF folder between
5 - 10 MB. Empty the C:\Windows\temp folder and C:\temp folder, if you have one.
Empty Recycle Bin. Reboot normally. Then run that online virus scan and let me know
the results.
Install SpywareBlaster to help prevent future malware infections. (It's not a cleaner).
Be sure to download updates and enable all protection. It doesn't need to be running
to protect your system. Check for updates frequently:
JavaCool Software
It's strongly advised to use an alternative browser as your main browser. FireFox
(most popular) or Opera are a couple good choices. IE has too many security issues
and is very vulnerable to malware infections and hijackings. Hijackings are very
rare, with other browsers. If you stay with IE, I suggest IE-Spyads, also. For other
tips and suggestions, check this page below....
Dealing with Unwanted Spyware and Parasites
|
All messages in this thread [show all]
 |  |  | re: Multiple illegal operation errors on startup (Ms. Eagle: Wed, May 18, 2005, 10:40 am) |
| |
| |
Return to the Windows 98 Discussion Forum
|
|
