I have a question about Dealing with Bad Memory (RAM):

I am about ready to throw this computer out in the yard. I have checked everything that can be checked on it, and have run every system check that I have and still cant resolve the problem. Could it be that the memory is going bad? I get the IE had preformed an illegal function and will be shut down error for no apparent reason. It told me Outlook Exp. could not be opened because some file was missing and hasnt done that since. When I click on a link in Favorites, IF it opens, it takes forever to do so and when only one window is open, it may tell me that I am out of memory, even cleaning out cookies and history and such doesnt help sometimes. And the one that gets me the most is when I run the Web Clean in Norton it will tell me that IE is loaded and needs to be closed, but it is not open. I close everything when I run Norton or any other system check. Does this sound like the memory is going bad? I have 128mb and havent had these problems until the last 3-4 wks. Any suggestions?

[Reply or follow-up to this message]

Try repairing I.E. first, whichever way you choose.
 
Go to Control Panel (Start / Settings / Ctrl. Panel)

1. Add-Remove Prog. 
2. Highlight MSIE & Tools
3. Click Add-Remove
4. Repair I. Exp.---OK---Yes
5. Will prompt to restart PC

Or......
IE Repair Tool-- Start - Run - (type) msinfo32 - OK --Tools - IE Repair Tool -- Repair 
IE. 

Note: If you get an error message saying it cannot be repaired, redownload and install 
then run the repair.

Then trim down your startup list. Right-click on the icons in the tray area, open 
each, go through the options to turn off the "tray" or "run at startup" feature. 

For the others, go to Start - Run, type: msconfig. Under startup tab....  Leave Systray, 
Scan Registry, Load Power Profile (two), firewall, if you have one. 

Note: Load Power Profile only if you use power saving schemes. For info. on any other 
processes that you have, check here....

Msconfig....Things safe to remove from startup:

Startups

Try this DLL Tweak. Windows doesn't do very well at unloading dll's from memory, 
when you close programs. This will help free up resources.

Unload DLLs

[Reply or follow-up to this message]

Have yo done a virus check.  The several different problems like missing files and 
programs that won't open suggests either a virus or some major screw up in file management. 
 Did you run scandisk or Norton Disk Doctor?  Did either report errors?  Also, you 
should check that the memory is firmly seated in the motherboard 






On Saturday, January 18, 2003 at 2:43 pm, eroberts wrote:
>I have a question about Dealing 
>with Bad Memory (RAM):

>I am about ready to throw this computer out in the yard.  I have checked everything 
>that can be checked on it, and have run every system check that I have and still 
>cant resolve the problem.  Could it be that the memory is going bad?  I get the 
IE 
>had preformed an illegal function and will be shut down error for no apparent reason. 
> It told me Outlook Exp. could not be opened because some file was missing and hasnt 
>done that since.  When I click on a link in Favorites, IF it opens, it takes forever 
>to do so and when only one window is open, it may tell me that I am out of memory, 
>even cleaning out cookies and history and such doesnt help sometimes.  And the one 
>that gets me the most is when I run the Web Clean in Norton it will tell me that 
>IE is loaded and needs to be closed, but it is not open.  I close everything when 
>I run Norton or any other system check.  Does this sound like the memory is going 
>bad?  I have 128mb and havent had these problems until the last 3-4 wks.  Any suggestions?
>
>

[Reply or follow-up to this message]

Just a simple question.....have you changed anything prior to this problem? Added 
software/hardware? You may also have to many unnecessary background programs running. 
Norton itself included!



      JmC

Yes, I have checked for viruses, run Disk Doctor, I am not getting any error reports when I run Norton,except that it wont let me run the Web Clean saying that IE is loaded. If its loaded, I sure cant tell by looking. I close everything before I run these checks. I have not installed or uninstalled anything recently. These errors have started cropping up for no apparent reason or rather I am not aware of any reason. A month ago things were fine. Inst. Msngr. cuts me off in mid sentence and I also get the Microsoft has encountered a problem and will shut down, sorry for the inconvenience. Im beginning to think its not me but MS. How can I tell if a prog. is running in the background?


On Saturday, January 18, 2003 at 2:43 pm, eroberts wrote:
>I have a question about Dealing
>with Bad Memory (RAM):

>I am about ready to throw this computer out in the yard. I have checked everything
>that can be checked on it, and have run every system check that I have and still
>cant resolve the problem. Could it be that the memory is going bad? I get the IE
>had preformed an illegal function and will be shut down error for no apparent reason.
> It told me Outlook Exp. could not be opened because some file was missing and hasnt
>done that since. When I click on a link in Favorites, IF it opens, it takes forever
>to do so and when only one window is open, it may tell me that I am out of memory,
>even cleaning out cookies and history and such doesnt help sometimes. And the one
>that gets me the most is when I run the Web Clean in Norton it will tell me that
>IE is loaded and needs to be closed, but it is not open. I close everything when
>I run Norton or any other system check. Does this sound like the memory is going
>bad? I have 128mb and havent had these problems until the last 3-4 wks. Any suggestions?
>
>

[Reply or follow-up to this message]

This will show everything running....Go to Start/Run  and type Msinfo32, followed 
by OK. Go to Software Environment/Startup Programs. 

Check in msconfig under the startup tab. Check the load= and run=  lines in Win.ini 
for something unusual. 

[Reply or follow-up to this message]

I havent added or deleted anything in quite a while. I have had Norton on here for some time and never had this problem before. How can I tell if something else is running in the background. I always close all programs and windows before I run the checks. I would get an error of some sort now and then and it became more frequent and now I get them half a dozen times a day. I have tried to notice what happens when an error occurs and as far as I can tell, I'm not doing anything different from 6 mos ago when things ran fine. Could the memory going bad cause all this?


On Saturday, January 18, 2003 at 2:43 pm, eroberts wrote:
>I have a question about Dealing
>with Bad Memory (RAM):

>I am about ready to throw this computer out in the yard. I have checked everything
>that can be checked on it, and have run every system check that I have and still
>cant resolve the problem. Could it be that the memory is going bad? I get the IE
>had preformed an illegal function and will be shut down error for no apparent reason.
> It told me Outlook Exp. could not be opened because some file was missing and hasnt
>done that since. When I click on a link in Favorites, IF it opens, it takes forever
>to do so and when only one window is open, it may tell me that I am out of memory,
>even cleaning out cookies and history and such doesnt help sometimes. And the one
>that gets me the most is when I run the Web Clean in Norton it will tell me that
>IE is loaded and needs to be closed, but it is not open. I close everything when
>I run Norton or any other system check. Does this sound like the memory is going
>bad? I have 128mb and havent had these problems until the last 3-4 wks. Any suggestions?
>
>

[Reply or follow-up to this message]

It may be some sort of spyware app, but you may have already checked that? Just FYI, 
Ad-Aware is no longer reliable. It hasn't been updated in months.

Download and run SpyBot Search and Destroy: 

SpyBot S&D

It looks for spyware, but also targets dialers, keyloggers and much more, and it's 
freeware. After installing, go to the Online tab, and search for and install all 
updates. 

Next, go to the Settings tab > File Sets, and uncheck 'System Internals' and 'Tracks.' 
You can always experiment with them later on. Just scan for the spybots for now. 
After closing your browser (signing off), run the scan, then click 'Check 
All', and have SpyBot remove all it finds. 

Note: SSD will sometimes not be able to remove all active components on the first 
'fix'. You will then get a dialog asking you to run SSD at next start. Click yes 
and reboot. SSD will then come up before the system puts these components 'in use'. 
You will then be able to 'fix' everything.

[Reply or follow-up to this message]

Or as an alternative to Carol's suggestion:

To help diagnose your problem, you could download STARTUPLIST. 

Unzip it, then doubleclick it and it will generate a text file that will list all 
running processes on your system. There may be a program that's causing the disk 
access. When the list completes, go to Edit then Select all, then copy 
and paste the contents here. 



      JmC

I wouldn't worry about the memory really. Just follow JmC's instructions on running that startup list app and posting the results, so he can check it out for something suspicious that may be causing the problem.

[Reply or follow-up to this message]

One thing at a time always helps, too! 

[Reply or follow-up to this message]

Be sure to check the box to select ....'Check this box to preserve your spacing' 
in your reply.



      JmC

Carol....I did the start, run, msinfor32........it didnt tell me there was something wrong. And it did restart the PC. So I will work with the comp and see if that cured the prob. It does seem like it runs a little faster. I surely do appreciate you folks helping me. I was at my wits end. I am copying all the suggestions and will try them one by one, and the ones Jmc suggested too. Something is bound to give....I just hope it's not my sanity!! I will let you know what happens. Thanx


On Saturday, January 18, 2003 at 2:43 pm, eroberts wrote:
>I have a question about Dealing
>with Bad Memory (RAM):

>I am about ready to throw this computer out in the yard. I have checked everything
>that can be checked on it, and have run every system check that I have and still
>cant resolve the problem. Could it be that the memory is going bad? I get the IE
>had preformed an illegal function and will be shut down error for no apparent reason.
> It told me Outlook Exp. could not be opened because some file was missing and hasnt
>done that since. When I click on a link in Favorites, IF it opens, it takes forever
>to do so and when only one window is open, it may tell me that I am out of memory,
>even cleaning out cookies and history and such doesnt help sometimes. And the one
>that gets me the most is when I run the Web Clean in Norton it will tell me that
>IE is loaded and needs to be closed, but it is not open. I close everything when
>I run Norton or any other system check. Does this sound like the memory is going
>bad? I have 128mb and havent had these problems until the last 3-4 wks. Any suggestions?
>
>

[Reply or follow-up to this message]

StartupList report, 1/18/03, 7:33:17 PM StartupList version: 1.51 Started from : C:\WINDOWS\TEMP\STARTUPLIST.EXE Detected: Windows 98 SE (Win9x 4.10.2222A) Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106) * Using default options ================================================== Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\MSTASK.EXE C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON CLEANSWEEP\CSINJECT.EXE C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON UTILITIES\NPROTECT.EXE C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SYMTRAY.EXE C:\PROGRAM FILES\NORTON PERSONAL FIREWALL\NISSERV.EXE C:\WINDOWS\EXPLORER.EXE C:\PROGRAM FILES\NORTON PERSONAL FIREWALL\NISUM.EXE C:\PROGRAM FILES\NORTON PERSONAL FIREWALL\SYMPROXYSVC.EXE C:\WINDOWS\PTSNOOP.EXE C:\WINDOWS\TASKMON.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\WINDOWS\LOADQM.EXE C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE C:\PROGRAM FILES\NORTON PERSONAL FIREWALL\IAMAPP.EXE C:\PROGRAM FILES\FARSTONE\VIRTUALDRIVE\VDTASK.EXE C:\WINDOWS\VCDPLAYX.EXE C:\WINDOWS\SYSTEM\QTTASK.EXE C:\WINDOWS\RUNDLL32.EXE C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON CLEANSWEEP\CSINSM32.EXE C:\WINDOWS\SYSTEM\DDHELP.EXE C:\Program Files\Norton SystemWorks\Norton CleanSweep\Monwow.exe C:\PROGRAM FILES\NORTON PERSONAL FIREWALL\ATRACK.EXE C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE C:\WINDOWS\SYSTEM\DLLHOST.EXE C:\PROGRAM FILES\WINACE\WINACE.EXE C:\WINDOWS\TEMP\STARTUPLIST.EXE -------------------------------------------------- Listing of startup folders: Shell folders Startup: [C:\WINDOWS\Start Menu\Programs\StartUp] Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE CleanSweep Smart Sweep-Internet Sweep.lnk = C:\Program Files\Norton SystemWorks\Norton CleanSweep\csinsm32.exe Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe -------------------------------------------------- Autorun entries from Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\Run ScanRegistry = C:\WINDOWS\scanregw.exe /autorun TaskMonitor = C:\WINDOWS\taskmon.exe SystemTray = SysTray.Exe LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme LoadQM = loadqm.exe CriticalUpdate = C:\WINDOWS\SYSTEM\wucrtupd.exe -startup ccApp = "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" ccRegVfy = "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" NPROTECT = C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE iamapp = C:\Program Files\Norton Personal Firewall\IAMAPP.EXE VirtualDrive = "C:\Program Files\FarStone\VirtualDrive\VDTask.exe" /AutoRestore vcdplayx = "C:\WINDOWS\vcdplayx.exe" (Default) = QuickTime Task = "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime New.net Startup = rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup -------------------------------------------------- Autorun entries from Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme SchedulingAgent = mstask.exe ccEvtMgr = "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe" ScriptBlocking = "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg CSINJECT.EXE = C:\Program Files\Norton SystemWorks\Norton CleanSweep\CSINJECT.EXE NPROTECT = C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE SymTray - Norton SystemWorks = C:\Program Files\Common Files\Symantec Shared\SymTray.exe "Norton SystemWorks" nisserv = C:\Program Files\Norton Personal Firewall\NISSERV.EXE -------------------------------------------------- Autorun entries from Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Run msnmsgr = "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background -------------------------------------------------- C:\WINDOWS\WININIT.BAK listing: (Created 16/1/2003, 3:19:52) [Rename] C:\WINDOWS\system.bak=C:\WINDOWS\system.dat C:\WINDOWS\user.bak=C:\WINDOWS\user.dat C:\WINDOWS\system.dat=C:\WINDOWS\system.pak C:\WINDOWS\user.dat=C:\WINDOWS\user.pak -------------------------------------------------- Enumerating Browser Helper Objects: NAV Helper - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872} WishBoneMedia MicroInstall BOH - C:\WINDOWS\SYSTEM\WBM\MINST.DLL - {3AA90BC2-58C0-4F4D-A87C-2C6F3D3CD5FE} WishBoneMedia PopDisabler - C:\WINDOWS\SYSTEM\WBM\WBM.DLL - {C331BD6E-06AB-41A0-B95F-D7CA379ACEAA} (no name) - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (no name) - C:\Program Files\NewDotNet\newdotnet4_50.dll - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} -------------------------------------------------- Enumerating Task Scheduler jobs: Tune-up Application Start.job Symantec NetDetect.job Norton SystemWorks One Button Checkup.job Norton AntiVirus - Scan my computer.job Maintenance-Defragment programs.job Maintenance-ScanDisk.job Maintenance-Disk cleanup.job Windows Critical Update Notification.job Norton Optimization Wizard.job -------------------------------------------------- Enumerating Download Program Files: [Update Class] InProcServer32 = C:\WINDOWS\SYSTEM\IUCTL.DLL CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37598.8725810185 [Shockwave Flash Object] InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab [{BD11A280-2E73-11CF-B6CF-00AA00A74DAF}] CODEBASE = http://www.talkingbuddy.com/talkingbuddyinstall.exe [WBMInstaller Class] InProcServer32 = C:\WINDOWS\SYSTEM\WBM\MINST.DLL CODEBASE = http://toolbar.wishbone.com/uinstaller.php OSD = C:\WINDOWS\Downloaded Program Files\microinstaller.osd [RdxIE Class] InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\RDXIE.DLL CODEBASE = http://207.188.7.150/228105b5e3b5a160e301/netzip/RdxIE601.cab [Shockwave ActiveX Control] InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\DIRECTOR\SWDIR.DLL CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab [{41F17733-B041-4099-A042-B518BB6A408C}] CODEBASE = http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/borris/us/win/QuickTimeInstaller.exe -------------------------------------------------- Enumerating Winsock LSP files: NameSpace #1: C:\Program Files\NewDotNet\newdotnet4_50.dll Protocol #1: C:\PROGRAM FILES\NEWDOTNET\NEWDOTNET4_50.DLL Protocol #2: C:\PROGRAM FILES\NEWDOTNET\NEWDOTNET4_50.DLL Protocol #9: C:\PROGRAM FILES\NEWDOTNET\NEWDOTNET4_50.DLL Protocol #10: C:\PROGRAM FILES\NEWDOTNET\NEWDOTNET4_50.DLL -------------------------------------------------- End of report, 7,884 bytes Report generated in 0.866 seconds Command line options: /verbose - to add additional info on each section /complete - to include empty sections and unsuspicious data /full - to include several rarely-important sections /force9x - to include Win9x-only startups even if running on WinNT /forcent - to include WinNT-only startups even if running on Win9x /forceall - to include all Win9x and WinNT startups, regardless of platform /history - to list version history only


On Saturday, January 18, 2003 at 4:21 pm, JmC wrote:
>

>

>
>Or as an alternative to Carol's suggestion:
>
>To help diagnose your problem, you could download color='orange'>STARTUPLIST. 
>
>Unzip it, then doubleclick it and it will generate a text file that will list all 
>running processes on your system. There may be a program that's causing the disk 
>access. When the list completes, go to Edit then Select all, then 
copy 
>and paste the contents here. 
>
>
>
>      JmC
>

>

This is just a start. 

NewdotNet foistware:
http://www.cexx.org/newnet.htm

Follow Microsoft's instructions to kill the Find Fast Indexer. It interferes badly 
with system performance and maintenance. Note: Do NOT renable it, it's usless and 
uses lots of resources.

Kill Find Fast

Plus, remove OSA from startup and get rid of PTSnoop. Open MSN Messenger, go to Tools 
- Options - Preferences tab. Uncheck "Run this program when Windows starts" and "Allow 
this program to run in the background."

PTSnoop Quote:

"Ptsnoop.exe is a program installed with some modems that monitors the COM ports 
for the modem driver. It's not actually necessary for using your modem. To stop the 
error message, you can open C:\WINDOWS\WIN.INI with a text editor such as Notepad 
or Word Pad.

Locate and delete the reference to Ptsnoop in either the LOAD= or RUN= lines at the 
top of the file, and save the file. (Leave the LOAD= and RUN= references.) 

Check the Windows Registry by selecting Start*Run, typing RegEdit, and pressing Enter. 
Navigate to HKEY_ LOCAL_ MACHINE\Software\Microsoft\ Windows\CurrentVersion\Run. 
If you see a reference to Ptsnoop in the right window, simply highlight that reference 
and press Del, then close the Registry. Restart Windows and you're done." 

Or, it can be Ptsnoop backdoor Trojan:

http://www.f-secure.com/v-descs/ptsnoop.shtml 

[Reply or follow-up to this message]

Good job Carol! No wonder he's having problems. I won't be back on until later this 
evening and I'll check back them. Definitely a good start though. Bugs.........



      JmC

>
>This is just a start. 
>
>NewdotNet foistware:
>http://www.cexx.org/newnet.htm
>
>Follow Microsoft's instructions to kill the Find Fast Indexer. It interferes badly 
>with system performance and maintenance. Note: Do NOT renable it, it's usless and 
>uses lots of resources.
>
>Kill Find Fast
>
>Plus, remove OSA from startup and get rid of PTSnoop. Open MSN Messenger, go to 
Tools 
>- Options - Preferences tab. Uncheck "Run this program when Windows starts" and 
"Allow 
>this program to run in the background."
>
>PTSnoop Quote:
>
>"Ptsnoop.exe is a program installed with some modems that monitors the COM ports 
>for the modem driver. It's not actually necessary for using your modem. To stop 
the 
>error message, you can open C:\WINDOWS\WIN.INI with a text editor such as Notepad 
>or Word Pad.
>
>Locate and delete the reference to Ptsnoop in either the LOAD= or RUN= lines at 
the 
>top of the file, and save the file. (Leave the LOAD= and RUN= references.) 
>
>Check the Windows Registry by selecting Start*Run, typing RegEdit, and pressing 
Enter. 
>Navigate to HKEY_ LOCAL_ MACHINE\Software\Microsoft\ Windows\CurrentVersion\Run. 
>If you see a reference to Ptsnoop in the right window, simply highlight that reference 
>and press Del, then close the Registry. Restart Windows and you're done." 
>
>Or, it can be Ptsnoop backdoor Trojan:
>
>http://www.f-secure.com/v-descs/ptsnoop.shtml 
>
>

I must be going blind from looking at this stuff! Where's the System.ini and Win.ini 
listings?



      JmC

>
>This is just a start. 
>
>NewdotNet foistware:
>http://www.cexx.org/newnet.htm
>
>Follow Microsoft's instructions to kill the Find Fast Indexer. It interferes badly 
>with system performance and maintenance. Note: Do NOT renable it, it's usless and 
>uses lots of resources.
>
>Kill Find Fast
>
>Plus, remove OSA from startup and get rid of PTSnoop. Open MSN Messenger, go to 
Tools 
>- Options - Preferences tab. Uncheck "Run this program when Windows starts" and 
"Allow 
>this program to run in the background."
>
>PTSnoop Quote:
>
>"Ptsnoop.exe is a program installed with some modems that monitors the COM ports 
>for the modem driver. It's not actually necessary for using your modem. To stop 
the 
>error message, you can open C:\WINDOWS\WIN.INI with a text editor such as Notepad 
>or Word Pad.
>
>Locate and delete the reference to Ptsnoop in either the LOAD= or RUN= lines at 
the 
>top of the file, and save the file. (Leave the LOAD= and RUN= references.) 
>
>Check the Windows Registry by selecting Start*Run, typing RegEdit, and pressing 
Enter. 
>Navigate to HKEY_ LOCAL_ MACHINE\Software\Microsoft\ Windows\CurrentVersion\Run. 
>If you see a reference to Ptsnoop in the right window, simply highlight that reference 
>and press Del, then close the Registry. Restart Windows and you're done." 
>
>Or, it can be Ptsnoop backdoor Trojan:
>
>http://www.f-secure.com/v-descs/ptsnoop.shtml 
>
>

Jerry,

I've just been looking at in the preview pane! I edited and enlarged the window, 
but you can copy/paste from the preview pane into Note Tab....works great! Otherwise, 
forget it.

I hadn't thought about Win.ini and system.ini......just been going through the list. 
He could probably run that again, after getting rid of what I gave him so far? I 
have a bit more to post.

[Reply or follow-up to this message]

You need to get rid of some ActiveX objects. 

ActiveX Controls are Downloaded program files like Shockwave or Flash. 

Go to Internet Options > General tab > Temp Internet files > Settings > Show objects, 
and get rid of ALL ActiveX objects, except those by Microsoft, Macromedia and Apple. 
Right click and choose Remove.

If any of the above are marked 'damaged', delete them, also. You'll be prompted to 
download them again whenever neccessary. 

Enumerating Download Program Files:

(These are the ones that should be removed) Btw, I don't what that Talking Buddy 
is.

Remove::::

[{BD11A280-2E73-11CF-B6CF-00AA00A74DAF}]
CODEBASE = http://www.talkingbuddy.com/talkingbuddyinstall.exe

Remove::::::

[WBMInstaller Class]
InProcServer32 = C:\WINDOWS\SYSTEM\WBM\MINST.DLL
CODEBASE = http://toolbar.wishbone.com/uinstaller.php
OSD = C:\WINDOWS\Downloaded Program Files\microinstaller.osd

Remove:::::::

[RdxIE Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\RDXIE.DLL
CODEBASE = http://207.188.7.150/228105b5e3b5a160e301/netzip/RdxIE601.cab

--------------------------------------------
After following all the previous removal instructions, could you please run that 
Startup List again. There's no reference to Win.ini or System.ini in your previous 
posting. The Startup list should have had that in it.

Plus, BE SURE TO check this below the message box, before you post. It'll format 
your post. Otherwise, the whole works is running together and practically impossible 
to look at. It's too hard on the eyes! 

Check this box to preserve your spacing, or leave it unchecked to have your text 
wrapped automatically. Don't use this option unless you really need it. If you're 
not sure, use the Preview feature below before posting. 

StartupList report, 1/18/03, 7:33:17 PM
StartupList version: 1.51
Started from : C:\WINDOWS\TEMP\STARTUPLIST.EXE
Detected: Windows 98 SE (Win9x 4.10.2222A)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON CLEANSWEEP\CSINJECT.EXE
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON UTILITIES\NPROTECT.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SYMTRAY.EXE
C:\PROGRAM FILES\NORTON PERSONAL FIREWALL\NISSERV.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\NORTON PERSONAL FIREWALL\NISUM.EXE
C:\PROGRAM FILES\NORTON PERSONAL FIREWALL\SYMPROXYSVC.EXE
C:\WINDOWS\PTSNOOP.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\NORTON PERSONAL FIREWALL\IAMAPP.EXE
C:\PROGRAM FILES\FARSTONE\VIRTUALDRIVE\VDTASK.EXE
C:\WINDOWS\VCDPLAYX.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON CLEANSWEEP\CSINSM32.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\Program Files\Norton SystemWorks\Norton CleanSweep\Monwow.exe
C:\PROGRAM FILES\NORTON PERSONAL FIREWALL\ATRACK.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\DLLHOST.EXE
C:\PROGRAM FILES\WINACE\WINACE.EXE
C:\WINDOWS\TEMP\STARTUPLIST.EXE

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\WINDOWS\Start Menu\Programs\StartUp]
Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
CleanSweep Smart Sweep-Internet Sweep.lnk = C:\Program Files\Norton SystemWorks\Norton 
CleanSweep\csinsm32.exe
Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma 
Loader.exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

ScanRegistry = C:\WINDOWS\scanregw.exe /autorun
TaskMonitor = C:\WINDOWS\taskmon.exe
SystemTray = SysTray.Exe
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
LoadQM = loadqm.exe
CriticalUpdate = C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
ccApp = "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
ccRegVfy = "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
NPROTECT = C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
iamapp = C:\Program Files\Norton Personal Firewall\IAMAPP.EXE
VirtualDrive = "C:\Program Files\FarStone\VirtualDrive\VDTask.exe" /AutoRestore
vcdplayx = "C:\WINDOWS\vcdplayx.exe"
(Default) = 
QuickTime Task = "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
New.net Startup = rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
SchedulingAgent = mstask.exe
ccEvtMgr = "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
ScriptBlocking = "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" 
-reg
CSINJECT.EXE = C:\Program Files\Norton SystemWorks\Norton CleanSweep\CSINJECT.EXE
NPROTECT = C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
SymTray - Norton SystemWorks = C:\Program Files\Common Files\Symantec Shared\SymTray.exe 
"Norton SystemWorks"
nisserv = C:\Program Files\Norton Personal Firewall\NISSERV.EXE

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

msnmsgr = "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 16/1/2003, 3:19:52)

[Rename]
C:\WINDOWS\system.bak=C:\WINDOWS\system.dat
C:\WINDOWS\user.bak=C:\WINDOWS\user.dat
C:\WINDOWS\system.dat=C:\WINDOWS\system.pak
C:\WINDOWS\user.dat=C:\WINDOWS\user.pak

--------------------------------------------------


Enumerating Browser Helper Objects:

NAV Helper - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll - 
{BDF3E430-B101-42AD-A544-FADC6B084872}
WishBoneMedia MicroInstall BOH - C:\WINDOWS\SYSTEM\WBM\MINST.DLL - {3AA90BC2-58C0-4F4D-A87C-2C6F3D3CD5FE}
WishBoneMedia PopDisabler - C:\WINDOWS\SYSTEM\WBM\WBM.DLL - {C331BD6E-06AB-41A0-B95F-D7CA379ACEAA}
(no name) - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX - 
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\Program Files\NewDotNet\newdotnet4_50.dll - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Tune-up Application Start.job
Symantec NetDetect.job
Norton SystemWorks One Button Checkup.job
Norton AntiVirus - Scan my computer.job
Maintenance-Defragment programs.job
Maintenance-ScanDisk.job
Maintenance-Disk cleanup.job
Windows Critical Update Notification.job
Norton Optimization Wizard.job

--------------------------------------------------

Enumerating Download Program Files:

[Update Class]
InProcServer32 = C:\WINDOWS\SYSTEM\IUCTL.DLL
CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37598.8725810185

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[{BD11A280-2E73-11CF-B6CF-00AA00A74DAF}]
CODEBASE = http://www.talkingbuddy.com/talkingbuddyinstall.exe

[WBMInstaller Class]
InProcServer32 = C:\WINDOWS\SYSTEM\WBM\MINST.DLL
CODEBASE = http://toolbar.wishbone.com/uinstaller.php
OSD = C:\WINDOWS\Downloaded Program Files\microinstaller.osd

[RdxIE Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\RDXIE.DLL
CODEBASE = http://207.188.7.150/228105b5e3b5a160e301/netzip/RdxIE601.cab

[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\DIRECTOR\SWDIR.DLL
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab

[{41F17733-B041-4099-A042-B518BB6A408C}]
CODEBASE = http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/borris/us/win/QuickTimeInstaller.exe

--------------------------------------------------

Enumerating Winsock LSP files:

NameSpace #1: C:\Program Files\NewDotNet\newdotnet4_50.dll
Protocol #1: C:\PROGRAM FILES\NEWDOTNET\NEWDOTNET4_50.DLL
Protocol #2: C:\PROGRAM FILES\NEWDOTNET\NEWDOTNET4_50.DLL
Protocol #9: C:\PROGRAM FILES\NEWDOTNET\NEWDOTNET4_50.DLL
Protocol #10: C:\PROGRAM FILES\NEWDOTNET\NEWDOTNET4_50.DLL

--------------------------------------------------
End of report, 7,884 bytes
Report generated in 0.866 seconds

Command line options:
   /verbose  - to add additional info on each section
   /complete - to include empty sections and unsuspicious data
   /full     - to include several rarely-important sections
   /force9x  - to include Win9x-only startups even if running on WinNT
   /forcent  - to include WinNT-only startups even if running on Win9x
   /forceall - to include all Win9x and WinNT startups, regardless of platform
   /history  - to list version history only

[Reply or follow-up to this message]

Sorry I didnt get back to you today. Something unavoidable came up. I'll be back tomorrow afternoon late. Thanks for waiting............ER


On Saturday, January 18, 2003 at 9:08 pm, Carol wrote:

>
>You need to get rid of some ActiveX objects. 
>
>ActiveX Controls are Downloaded program files like Shockwave or Flash. 
>
>Go to Internet Options > General tab > Temp Internet files > Settings > Show objects, 
>and get rid of ALL ActiveX objects, except those by Microsoft, Macromedia and Apple. 
>Right click and choose Remove.
>
>If any of the above are marked 'damaged', delete them, also. You'll be prompted 
to 
>download them again whenever neccessary. 
>
>Enumerating Download Program Files:
>
>(These are the ones that should be removed) Btw, I don't what that Talking Buddy 
>is.
>
>Remove::::
>
>[{BD11A280-2E73-11CF-B6CF-00AA00A74DAF}]
>CODEBASE = http://www.talkingbuddy.com/talkingbuddyinstall.exe
>
>Remove::::::
>
>[WBMInstaller Class]
>InProcServer32 = C:\WINDOWS\SYSTEM\WBM\MINST.DLL
>CODEBASE = http://toolbar.wishbone.com/uinstaller.php
>OSD = C:\WINDOWS\Downloaded Program Files\microinstaller.osd
>
>Remove:::::::
>
>[RdxIE Class]
>InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\RDXIE.DLL
>CODEBASE = http://207.188.7.150/228105b5e3b5a160e301/netzip/RdxIE601.cab
>
>--------------------------------------------
>After following all the previous removal instructions, could you please run that 
>Startup List again. There's no reference to Win.ini or System.ini in your previous 
>posting. The Startup list should have had that in it.
>
>Plus, BE SURE TO check this below the message box, before you post. It'll format 
>your post. Otherwise, the whole works is running together and practically impossible 
>to look at. It's too hard on the eyes! 
>
>Check this box to preserve your spacing, or leave it unchecked to have your text 
>wrapped automatically. Don't use this option unless you really need it. If you're 
>not sure, use the Preview feature below before posting. 
>
>
>
>
>
>
>

StartupList report, 1/20/03, 5:43:10 PM
StartupList version: 1.51
Started from : C:\WINDOWS\TEMP\STARTUPLIST.EXE
Detected: Windows 98 SE (Win9x 4.10.2222A)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON CLEANSWEEP\CSINJECT.EXE
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON UTILITIES\NPROTECT.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SYMTRAY.EXE
C:\PROGRAM FILES\NORTON PERSONAL FIREWALL\NISSERV.EXE
C:\PROGRAM FILES\NORTON PERSONAL FIREWALL\NISUM.EXE
C:\PROGRAM FILES\NORTON PERSONAL FIREWALL\SYMPROXYSVC.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\NORTON PERSONAL FIREWALL\IAMAPP.EXE
C:\PROGRAM FILES\FARSTONE\VIRTUALDRIVE\VDTASK.EXE
C:\WINDOWS\VCDPLAYX.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON CLEANSWEEP\CSINSM32.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\Program Files\Norton SystemWorks\Norton CleanSweep\Monwow.exe
C:\PROGRAM FILES\NORTON PERSONAL FIREWALL\ATRACK.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\WINDOWS\SYSTEM\DLLHOST.EXE
C:\PROGRAM FILES\WINACE\WINACE.EXE
C:\WINDOWS\TEMP\STARTUPLIST.EXE

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\WINDOWS\Start Menu\Programs\StartUp]
Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
CleanSweep Smart Sweep-Internet Sweep.lnk = C:\Program Files\Norton SystemWorks\Norton 
CleanSweep\csinsm32.exe
Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma 
Loader.exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

ScanRegistry = C:\WINDOWS\scanregw.exe /autorun
TaskMonitor = C:\WINDOWS\taskmon.exe
SystemTray = SysTray.Exe
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
LoadQM = loadqm.exe
CriticalUpdate = C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
ccApp = "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
ccRegVfy = "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
NPROTECT = C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
iamapp = C:\Program Files\Norton Personal Firewall\IAMAPP.EXE
VirtualDrive = "C:\Program Files\FarStone\VirtualDrive\VDTask.exe" /AutoRestore
vcdplayx = "C:\WINDOWS\vcdplayx.exe"
(Default) = 
QuickTime Task = "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
SchedulingAgent = mstask.exe
ccEvtMgr = "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
ScriptBlocking = "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" 
-reg
CSINJECT.EXE = C:\Program Files\Norton SystemWorks\Norton CleanSweep\CSINJECT.EXE
NPROTECT = C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
SymTray - Norton SystemWorks = C:\Program Files\Common Files\Symantec Shared\SymTray.exe 
"Norton SystemWorks"
nisserv = C:\Program Files\Norton Personal Firewall\NISSERV.EXE

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 19/1/2003, 0:25:6)

[Rename]
NUL=C:\WINDOWS\UNVISE32.EXE
NUL=C:\WINDOWS\UNVISE32.EXE
NUL=C:\PROGRA~1\DELFIN\PROMUL~1\PGSDK.DLL
NUL=C:\PROGRA~1\DELFIN\PROMUL~1\PGMONITR.EXE
NUL=C:\PROGRA~1\DELFIN\PROMUL~1\DELFINCO.EDX
NUL=C:\PROGRA~1\DELFIN\PROMUL~1\DELFINLD.EDX
NUL=C:\PROGRA~1\DELFIN\PROMUL~1\DELFINLO.EBD
NUL=C:\PROGRA~1\DELFIN\PROMUL~1\DELFINID.EDX
NUL=C:\PROGRA~1\DELFIN\PROMUL~1\DELFINED.EDX
NUL=C:\PROGRA~1\DELFIN\PROMUL~1\DELFINDL.EDX
NUL=C:\PROGRA~1\DELFIN\PROMUL~1\DELFINBD.EDX
NUL=C:\PROGRA~1\DELFIN\PROMUL~1\DELFINAF.EDX
NUL=C:\PROGRA~1\DELFIN\PROMUL~1\DELFINAD.EBD
NUL=C:\PROGRA~1\NEWDOT~1\UNINST~1.EXE
NUL=C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL
NUL=C:\PROGRA~1\FIRSTL~1\FIRSTL~1.EXE

--------------------------------------------------


Enumerating Browser Helper Objects:

NAV Helper - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll - 
{BDF3E430-B101-42AD-A544-FADC6B084872}
WishBoneMedia MicroInstall BOH - C:\WINDOWS\SYSTEM\WBM\MINST.DLL - {3AA90BC2-58C0-4F4D-A87C-2C6F3D3CD5FE}
WishBoneMedia PopDisabler - C:\WINDOWS\SYSTEM\WBM\WBM.DLL - {C331BD6E-06AB-41A0-B95F-D7CA379ACEAA}
(no name) - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX - 
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Tune-up Application Start.job
Symantec NetDetect.job
Norton SystemWorks One Button Checkup.job
Norton AntiVirus - Scan my computer.job
Maintenance-Defragment programs.job
Maintenance-ScanDisk.job
Maintenance-Disk cleanup.job
Windows Critical Update Notification.job
Norton Optimization Wizard.job

--------------------------------------------------

Enumerating Download Program Files:

[Update Class]
InProcServer32 = C:\WINDOWS\SYSTEM\IUCTL.DLL
CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37598.8725810185

[WBMInstaller Class]
InProcServer32 = C:\WINDOWS\SYSTEM\WBM\MINST.DLL
CODEBASE = http://toolbar.wishbone.com/uinstaller.php
OSD = C:\WINDOWS\Downloaded Program Files\microinstaller.osd

[{41F17733-B041-4099-A042-B518BB6A408C}]
CODEBASE = http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/borris/us/win/QuickTimeInstaller.exe

--------------------------------------------------
End of report, 6,744 bytes
Report generated in 0.731 seconds

Command line options:
   /verbose  - to add additional info on each section
   /complete - to include empty sections and unsuspicious data
   /full     - to include several rarely-important sections
   /force9x  - to include Win9x-only startups even if running on WinNT
   /forcent  - to include WinNT-only startups even if running on Win9x
   /forceall - to include all Win9x and WinNT startups, regardless of platform
   /history  - to list version history only







On Saturday, January 18, 2003 at 8:34 pm, JmC wrote:
>
>

>
>I must be going blind from looking at this stuff! Where's the System.ini and Win.ini 
>listings?
>
>
>
>      JmC
>

>

>
>
>
>

Ok, Im back, thanx for waiting for me. This is what I have done thus far: Repair IE (both ways) Forced Dll unload-(I think)-was I supposed to download that tweak or just make that folder with the value of '1'? Disable MSN on startup Del talking buddy from register-was on Photoshop tutor Del RdxIE Class Del Active X-think I got them all Del Fast Find Del Ptsnoop in registry as instruction said, but later I run the Find prog in Registry and it found the following: HKey_Current_Users\..........\Explorer\Doc Find Spec MRU name: b firstlook c registry d win.ini e Rdxie.dll f Active X g OSA-what is this? h Active X i Ptsnoop j Trash App MRU List eafhgibidc


On the first runthrough in registry, I did not find any trash apps And I am presently working on the Spybot program. Sorry about not setting the format on the startup items, but I think I got it this time. Comp is running a little better, just got and illegal function error trying to open this forum, But that is the only one I have seen this afternoon. I was amazed when I ran spybot the first time............!!! wow! ER


On Saturday, January 18, 2003 at 8:52 pm, Carol wrote:

>
>Jerry,
>
>I've just been looking at in the preview pane! I edited and enlarged the window, 
>but you can copy/paste from the preview pane into Note Tab....works great! Otherwise, 
>forget it.
>
>I hadn't thought about Win.ini and system.ini......just been going through the list. 
>He could probably run that again, after getting rid of what I gave him so far? I 
>have a bit more to post.
>
>

[Reply or follow-up to this message]

I know, that Spybot S&D is quite a program. Anyway, we need to see the entire startup 
list. We still don't have the Win.ini and System.ini listed. That's part of it, so 
you could please post those sections? You don't have to repost the rest of it. For 
now...

You said, I run the Find prog in Registry and it found the following: HKey_Current_Users\..........\Explorer\Doc 
Find Spec MRU name: b firstlook c registry d win.ini e Rdxie.dll f Active X g OSA-what 
is this? h Active X i Ptsnoop j Trash App MRU List eafhgibidc 

I don't know what the path is HKCU......\? but that's just a record of recently searched 
for items. It's deceiving to look around in the registry. These things can be taken 
care of without going into regedit, aside from that PTSnoop. Just forget that for 
now. 

OSA goes with Office program, just uncheck it in msconfig under the startup tab (or 
delete from startup folder, if it's there) Also, uncheck LoadQM and Taskmon.

C:\PROGRAM FILES\WINACE\WINACE.EXE = either a KaZaa file or part of a virus replicating 
as a KaZaa file. You have KaZaa installed then? Info. on that file:

W32duloada

More W32duloada

I don't know what FarStone is in your programs folder. If it's not necessary, remove 
it from your startup. You need to trim down your startups, too. 

NewdotNet is still in there. I believe the instructions at that link say to uninstall 
it in Add-Remove programs. Did you do that, or is it still there?

This is something interesting, I'd found out awhile back....
Quote:
Windows Update Critical Update Notification.  This will appear in your Task List 
if you did a Windows Update at some stage and installed the "Critical Update Notification" 
component.  Do not walk, run to your "Add/Remove Programs" icon in the Control Panel 
and immediately uninstall Microsoft Windows Critical Updates Notification. 
 

Recommendation : 
It is best that you simply do a Windows Update once every two or three months, say, 
and only at times when you do not require your PC urgently in the following 24 hours 
! Finally, quite aside from the above, WUCRTUPD is also sometimes responsible for 
illegal operations, 3-seconds mouse freezes, WULOADER error messages, and Invalid 
Page Faults in KERNEL32. Have we said enough ? 
End Quote.... from below site:

Tasklist

JmC will probably take a look to. This is just another step. 

[Reply or follow-up to this message]

I HAD Kazaa some time back but deleted it within 24 hrs when my son told me about it. But I didnt realize how intrusive it was. That winace.exe is my zip/compression prog. or has kazaa metamorphazied into making me think its the zip file? I have looked on the startup list and the win.ini and other files are not there. What I posted is all that it shows. Is there anyplace else to get these files? thru My Comp. maybe? I double check it again. That NewdotNet is not on the Add/Remove. I checked that the other night when I first started following your and Jmc's instructions. What's with the MS critical update notification? Whatever it is, it wont be there in 15 minutes. Ok, let me review your post and try to get caught up. I surfed a little bit earlier and didnt get near the number of illegal errors I was getting. Maybe we are about to get this thing by the throat. I couldn't do it without you and Jmc. Thanx


On Monday, January 20, 2003 at 7:16 pm, Carol wrote:

>
>I know, that Spybot S&D is quite a program. Anyway, we need to see the entire startup 
>list. We still don't have the Win.ini and System.ini listed. That's part of it, 
so 
>you could please post those sections? You don't have to repost the rest of it. For 
>now...
>
>You said, I run the Find prog in Registry and it found the following: HKey_Current_Users\..........\Explorer\Doc 
>Find Spec MRU name: b firstlook c registry d win.ini e Rdxie.dll f Active X g OSA-what 
>is this? h Active X i Ptsnoop j Trash App MRU List eafhgibidc 
>
>I don't know what the path is HKCU......\? but that's just a record of recently 
searched 
>for items. It's deceiving to look around in the registry. These things can be taken 
>care of without going into regedit, aside from that PTSnoop. Just forget that for 
>now. 
>
>OSA goes with Office program, just uncheck it in msconfig under the startup tab 
(or 
>delete from startup folder, if it's there) Also, uncheck LoadQM and Taskmon.
>
>C:\PROGRAM FILES\WINACE\WINACE.EXE = either a KaZaa file or part of a virus replicating 
>as a KaZaa file. You have KaZaa installed then? Info. on that file:
>
>W32duloada
>
>More W32duloada
>
>I don't know what FarStone is in your programs folder. If it's not necessary, remove 
>it from your startup. You need to trim down your startups, too. 
>
>NewdotNet is still in there. I believe the instructions at that link say to uninstall 
>it in Add-Remove programs. Did you do that, or is it still there?
>
>This is something interesting, I'd found out awhile back....
>Quote:
>Windows Update Critical Update Notification.  This will appear in your Task List 
>if you did a Windows Update at some stage and installed the "Critical Update Notification" 
>component.  Do not walk, run to your "Add/Remove Programs" icon in the Control Panel 
>and immediately uninstall Microsoft Windows Critical Updates Notification. 
> 
>
>Recommendation : 
>It is best that you simply do a Windows Update once every two or three months, say, 
>and only at times when you do not require your PC urgently in the following 24 hours 
>! Finally, quite aside from the above, WUCRTUPD is also sometimes responsible for 
>illegal operations, 3-seconds mouse freezes, WULOADER error messages, and Invalid 
>Page Faults in KERNEL32. Have we said enough ? 
>End Quote.... from below site:
>
>Tasklist
>
>JmC will probably take a look to. This is just another step. 
>

[Reply or follow-up to this message]

Well, just leave that Winace.exe alone then. I don't know about that. The only thing 
that came up in a Google search is KaZaa related. As for that NewdotNet, it must 
be a leftover, but I know they say NOT to simply delete that DLL, because of Winsock 
files. Just leave that alone too.

What might be a good idea, after you're through with all this, is to run JV 16 Power 
tools, the registry cleaner function of it, to clear out leftovers. It's a very reliable 
program and always creates a backup, but it's up to the user to be cautious. I don't 
use the other functions in it myself. 

You can open the Win.in and System.ini files using SysEdit then post just the load= 
and run= lines from both. (nothing else) Start - Run - type: sysedit

[Reply or follow-up to this message]

Sorry I didnt format the startup list last time. Guess I got in too big a hurry. I have looked several times on the list and system.ini and win.ini is not there. But I went to 'find files and folders' and typed in win.ini and notepad brought up a list that looks similiar to the startup list. Is that what you are wanting or is there another place to get it that is better? I did system.ini the same way.


On Saturday, January 18, 2003 at 8:34 pm, JmC wrote:
>

>

>
>I must be going blind from looking at this stuff! Where's the System.ini and Win.ini 
>listings?
>
>
>
>      JmC
>

>

win.ini shows 
run=hpfsched and
noload=(blank)

system.ini has neither run or load on it.  

I will copy the whole thing if you like.  Also where do I get this JV 16 Power Tool 
program?

I run spybot and cleaned out EVERYTHING it brought up....red and green.  Removed 
MS Critical Update Notification.

I think I will get rid of Winace...I dont understand all I know about that program. 
 It confuses me sometimes and I just dont like it.

Appears like we are making progress........computer is breathing better and I havent 
had but one error msg in about 4 hrs now.  That error msg was on Winace when I tried 
to get the startup list again.






On Monday, January 20, 2003 at 9:34 pm, Carol wrote:
>
>Well, just leave that Winace.exe alone then. I don't know about that. The only thing 
>that came up in a Google search is KaZaa related. As for that NewdotNet, it must 
>be a leftover, but I know they say NOT to simply delete that DLL, because of Winsock 
>files. Just leave that alone too.
>
>What might be a good idea, after you're through with all this, is to run JV 16 Power 
>tools, the registry cleaner function of it, to clear out leftovers. It's a very 
reliable 
>program and always creates a backup, but it's up to the user to be cautious. I don't 
>use the other functions in it myself. 
>
>You can open the Win.in and System.ini files using SysEdit then post just the load= 
>and run= lines from both. (nothing else) Start - Run - type: sysedit
>
>

[Reply or follow-up to this message]

I forget that System.ini doesn't have those lines. You can delete hpfsched after 
the run= line, but it's not a problem either way. No, don't worry about posting those 
files now. This should do it.

JV 16 Power Tools will clean out a lot of leftovers from the registry. I suggest 
the .exe download with the installer. 

http://www.jv16.org/ 

Then it would be a good idea to rebuild/repair the registry. There'll be a lot of 
empty space from all that removal, and that can cause corruption. It's recommended 
to do occassionally, anyway. Reboot and hold the CTRL button down, until you get 
the boot menu.

Choose Command prompt only. At the C:\> 
type: scanreg /opt and press enter (this will clean up the unused space left 
in your registry by all the deleted entries which can lead to possible registry corruption) 

At the next prompt, fix your registry, ie correct any errors by typing this: 

scanreg /fix > press enter. At the next prompt type 'win' and press enter 
to restart Windows.

Then you should be in pretty good shape!

[Reply or follow-up to this message]

C:\WINDOWS\WININIT.BAK listing:
(Created 19/1/2003, 0:25:6)

[Rename]
NUL=C:\WINDOWS\UNVISE32.EXE
NUL=C:\WINDOWS\UNVISE32.EXE
NUL=C:\PROGRA~1\DELFIN\PROMUL~1\PGSDK.DLL
NUL=C:\PROGRA~1\DELFIN\PROMUL~1\PGMONITR.EXE
NUL=C:\PROGRA~1\DELFIN\PROMUL~1\DELFINCO.EDX
NUL=C:\PROGRA~1\DELFIN\PROMUL~1\DELFINLD.EDX
NUL=C:\PROGRA~1\DELFIN\PROMUL~1\DELFINLO.EBD
NUL=C:\PROGRA~1\DELFIN\PROMUL~1\DELFINID.EDX
NUL=C:\PROGRA~1\DELFIN\PROMUL~1\DELFINED.EDX
NUL=C:\PROGRA~1\DELFIN\PROMUL~1\DELFINDL.EDX
NUL=C:\PROGRA~1\DELFIN\PROMUL~1\DELFINBD.EDX
NUL=C:\PROGRA~1\DELFIN\PROMUL~1\DELFINAF.EDX
NUL=C:\PROGRA~1\DELFIN\PROMUL~1\DELFINAD.EBD
NUL=C:\PROGRA~1\NEWDOT~1\UNINST~1.EXE
NUL=C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL
NUL=C:\PROGRA~1\FIRSTL~1\FIRSTL~1.EXE


Carol, I ran the JV16 then I checked the startup list again and this is still on 
it.  According to that site you sent the other day, all these are from kazaa.  Is 
it safe just to delete them?  Why didnt spybot catch them?

Also was I supposed to download that tweak to force dll unloading or just make the 
folder with the value of 1?






On Tuesday, January 21, 2003 at 2:25 am, Carol wrote:
>
>I forget that System.ini doesn't have those lines. You can delete hpfsched after 
>the run= line, but it's not a problem either way. No, don't worry about posting 
those 
>files now. This should do it.
>
>JV 16 Power Tools will clean out a lot of leftovers from the registry. I suggest 
>the .exe download with the installer. 
>
>http://www.jv16.org/ 
>
>Then it would be a good idea to rebuild/repair the registry. There'll be a lot of 
>empty space from all that removal, and that can cause corruption. It's recommended 
>to do occassionally, anyway. Reboot and hold the CTRL button down, until you get 
>the boot menu.
>
>Choose Command prompt only. At the C:\> 
>type: scanreg /opt and press enter (this will clean up the unused space left 
>in your registry by all the deleted entries which can lead to possible registry 
corruption) 
>
>At the next prompt, fix your registry, ie correct any errors by typing this: 
>
>scanreg /fix > press enter. At the next prompt type 'win' and press enter 
>to restart Windows.
>
>Then you should be in pretty good shape!
>

[Reply or follow-up to this message]

There are a lot of temp files with different extensions. Those .bak files are temporary 
files, so you can locate and delete WININIT.BAK. 

.bak - Old file; when a new version of a program comes along, sometimes it will 
rename the old version with an .bak extension. 

In fact, you might want to run scan disk to correct errors and defrag. First do this: 

Go to Find - Files or folders - in the named box type: *.tmp and choose Edit - select 
all - File - delete. Do the same for *.chk. Then type: temp. Empty the contents of 
the C:\Windows\temp folder. Delete this folder - C:\Windows\Applog; it will be re-created 
at bootup, but it'll be empty. Empty Recycle bin

That DLL tweak is something to help improve performance. It's not a necessity, just 
a suggestion. You just create that new subkey according to those instructions.

[Reply or follow-up to this message]

If you're concerned about virus, you could run one of these free online scans. Spybot 
S&D doesn't target virus files, but like I said earlier, that .bak file is a temp 
file.

Panda AV Scan

Trend Micro Housecall

[Reply or follow-up to this message]

Carol, my computer is working alot better now. I surely do want to thank you and Jmc for helping me. I've been in parts of this comp. that I didnt know was there...(msconfig, etc). I kinda think it was the spyware and IE that was messing things up. I have learned alot through all this and have kept everything so if it happens again, I will know how to fix it. I'll give the computer a good workout now just to make sure everything is ok. Once again, I thank you very much. Elaine


On Tuesday, January 21, 2003 at 9:41 pm, Carol wrote:

>
>If you're concerned about virus, you could run one of these free online scans. Spybot 
>S&D doesn't target virus files, but like I said earlier, that .bak file is a temp 
>file.
>
>Panda AV Scan
>
>Trend Micro Housecall
>
>

[Reply or follow-up to this message]

You're very welcome, and I hope it's all taken care of. If anything comes up just 
post a new message. These lengthy threads can get confusing, so JmC let me take care 
of it, since we had a good start. 

Spyware can really cause problems. One thing he made a note of was Norton. It's entirely 
up to you and depending on how you use your PC, but you might want to consider removing 
it from your startup. I know that sounds careless, but if you're not using a file 
sharing program, your risk isn't so high. Practicing safe computing, is the best 
prevention. You'd still want to scan attachments and downloads, etc., but you could 
just run it manually on a couple times a week or whenever you choose. 

It's constantly running and according to your startups, there are many instances 
of Norton. You could check against that link I posted, that shows tasks and gives 
a description of each and recommendation on whether it's necessary in startup. It's 
just a suggestion, and they do use resources. 

Happy Computing! 



 
Carol

[Reply or follow-up to this message]

Will do.........thanx ER


On Wednesday, January 22, 2003 at 1:23 pm, Carol wrote:

>
>You're very welcome, and I hope it's all taken care of. If anything comes up just 
>post a new message. These lengthy threads can get confusing, so JmC let me take 
care 
>of it, since we had a good start. 
>
>Spyware can really cause problems. One thing he made a note of was Norton. It's 
entirely 
>up to you and depending on how you use your PC, but you might want to consider removing 
>it from your startup. I know that sounds careless, but if you're not using a file 
>sharing program, your risk isn't so high. Practicing safe computing, is the best 
>prevention. You'd still want to scan attachments and downloads, etc., but you could 
>just run it manually on a couple times a week or whenever you choose. 
>
>It's constantly running and according to your startups, there are many instances 
>of Norton. You could check against that link I posted, that shows tasks and gives 
>a description of each and recommendation on whether it's necessary in startup. It's 
>just a suggestion, and they do use resources. 
>
>Happy Computing! 
>
>
>
> 
>Cacolor='#0000CC'>rol
>

[Reply or follow-up to this message]

Carol, everything seems to be running fine. I have a different question. No one I know can answer it and just today I thought maybe u could. Can I run DOS games on my computer? Its a 486 MMX processor. I have hundreds of them, but I dont have enough room to set up the DOS computer. There are some of the games I really miss and cannot find their Windows counterpart. I know most computers are written by C+ and C++ but I thought maybe I could play the games since there is a Dos mode on here. You can e-mail me if you like at: satjup@hotmail.com. Thanks again Elaine


On Thursday, January 23, 2003 at 12:33 am, eroberts wrote:
>Will do.........thanx
>ER
>
>

[Reply or follow-up to this message]

I think its the memory I have the same problem and I get paging file errors now and some games crash I'm waiting to get some new memory to test it out

[Reply or follow-up to this message]

I have been using Windows 2000 and Pentium 4-2.4C/512 DDR Ram and whenever I startup my pc the Norton Antivirus is missing from startup alternatively. Every alternate startup it is missing. Could it be a memory problem. There are no other applications in the startup. Another known issue for Windows 2000 with Minolta Laser Printers 1100L Model is that once you install the service pack 4, the PC will keep restarting whenever you open microsoft word or open printer properties. This is a known issue in Windows 2000 but QMS-Minolta doesnt want to resolve it as they claim that the printer model is obsolete and they wont release a patch for it. So just be careful about it.


On Friday, August 8, 2003 at 9:30 am, J wrote:
>I think its the memory I have the same problem and I get paging file errors now
>and some games crash I'm waiting to get some new memory to test it out

[Reply or follow-up to this message]

• Search this forum
• Start a new thread on a different subject

• Report abuse of the forum