Tip: Run a free scan for common Windows errors ad

re: Error while trying to install SWShredder Friday, March 26, 2004 at 9:29 am Posted by MrCharlie (4135 messages posted) Run this program first: CWS SmartKiller, then try to run the Shredder. Run the Shredder from your desktop - I've found that less errors occur. MrC On Friday, March 26, 2004 at 5:20 am, Levis wrote: >Can you please help me out coz, I've tried to install SWShredder but a message appears. >"You have a variant of the Coolwebsearch trojan (CES.Smartsearch.2) that has attempted >to close SWShredder. To counter this, CWShredder is now starting with a random string >of text in the title bar. CWShredderis stll functioning fine, it has not been corrupted. >...............". After I click ok it brings "this program has performed an ilegal >operation and will shut down". This problem begun when I started my computer and >it told me that a file "fntldr.exe" is missing. Everytime I try to run a program >it brings me "this program has performed an ilegal operation and will shut down". >Pliz I need your help coz I can nolonger work with the computer properly. [Reply or follow-up to this message] forgot to say.. Friday, March 26, 2004 at 9:33 am Posted by MrCharlie (4135 messages posted) I forgot to say that you have to unzip the SmartKiller first, then run it. On Friday, March 26, 2004 at 5:20 am, Levis wrote: >Can you please help me out coz, I've tried to install SWShredder but a message appears. >"You have a variant of the Coolwebsearch trojan (CES.Smartsearch.2) that has attempted >to close SWShredder. To counter this, CWShredder is now starting with a random string >of text in the title bar. CWShredderis stll functioning fine, it has not been corrupted. >...............". After I click ok it brings "this program has performed an ilegal >operation and will shut down". This problem begun when I started my computer and >it told me that a file "fntldr.exe" is missing. Everytime I try to run a program >it brings me "this program has performed an ilegal operation and will shut down". >Pliz I need your help coz I can nolonger work with the computer properly. [Reply or follow-up to this message] cannot find CoolWWWSearch.SmartKiller (v1/v2) Monday, March 29, 2004 at 4:54 am Posted by Levis (6 messages posted) Well Mr. Charles, I have unzipped and tried to run the smartkiller and is now telling me that "CoolWWWSearch.SmartKiller (v1/v2) has not been found on your system". I've also tried running CWShredder from the desktop and it's still bringing the same problem. Pliz try and find out a way I can deal with this problem. It's putting me in a mess. By the way I'm using Windows 95 and it happens to be in an institution where I'm currently doing my attachment. Pliz help me out. On Friday, March 26, 2004 at 9:33 am, MrCharlie wrote: > >I forgot to say that you have to unzip the SmartKiller first, then run it. > > > > >On Friday, March 26, 2004 at 5:20 am, Levis wrote: >>Can you please help me out coz, I've tried to install SWShredder but a message appears. >>"You have a variant of the Coolwebsearch trojan (CES.Smartsearch.2) that has attempted >>to close SWShredder. To counter this, CWShredder is now starting with a random string >>of text in the title bar. CWShredderis stll functioning fine, it has not been corrupted. >>...............". After I click ok it brings "this program has performed an ilegal >>operation and will shut down". This problem begun when I started my computer and >>it told me that a file "fntldr.exe" is missing. Everytime I try to run a program >>it brings me "this program has performed an ilegal operation and will shut down". >>Pliz I need your help coz I can nolonger work with the computer properly. [Reply or follow-up to this message] re: cannot find CoolWWWSearch.SmartKiller (v1/v2) Monday, March 29, 2004 at 3:15 pm Posted by MrCharlie (4135 messages posted) ThisIsWhatYouHave You have the CoolWebSearch or variant on your system, I don't know why you can't run the Shredder. Here's a direct download of the lastest version, download to and run it from your desktop. CW-Shredder. You can also start your computer in safe mode and try to run it then. As for the SmartKiller, it found nothing OK. You can also try and run Spybot, it looks for ad/spyware and may fix it. HiJackThis* CW-Shredder* Spybot Here's how to run it: How to Update Spybot 1. Click on 'Online' in the navigation bar, 2. Click on 'Update', 3. Search for available updates, 4. Select ALL available updates, 5. Select a download location nearest to you, USA usually works the best. 6. Download the selected updates. Updates will be installed without any further action needed. Next, close all Internet Explorer windows, hit 'Check for Problems', and have SpyBot remove/fix all it finds that are in RED You can also get a free virus check and fix - it may pick it up and isolate it - give it a try. Panda ActiveScan-VirusCheck Let me know, MrC On Monday, March 29, 2004 at 4:54 am, Levis wrote: >Well Mr. Charles, I have unzipped and tried to run the smartkiller and is now telling >me that "CoolWWWSearch.SmartKiller (v1/v2) has not been found on your system". I've >also tried running CWShredder from the desktop and it's still bringing the same problem. >Pliz try and find out a way I can deal with this problem. It's putting me in a mess. >By the way I'm using Windows 95 and it happens to be in an institution where I'm >currently doing my attachment. Pliz help me out. > > > [Reply or follow-up to this message] re: Now "Program has performed an illegal .... and will now shutdown" Tuesday, March 30, 2004 at 4:35 am Posted by Levis (6 messages posted) Thanks MrC, I have now been able to deal with the "fntldr.exe" problem when I installed CWShredder and Spybot in Safe Mode. But another error is still destroying the computers performance when you start the computer is normal mode. It's still bringing the error "Program has performed an illegal operation and will now be shut down". You can't surf without it bringing the error and it closes the browser. You also can't run any application and I think this is a major problem or virus. What I'm I going to do? It seems I can't run any program in normal mode and you know you are not able to browse in safe mode. On Monday, March 29, 2004 at 3:15 pm, MrCharlie wrote: > > ThisIsWhatYouHave > >You have the CoolWebSearch or variant on your system, I don't know why you can't >run the Shredder. Here's a direct download of the lastest version, download to and >run it from your desktop. CW-Shredder. >You can also start your computer in safe mode and try to run it then. As for the >SmartKiller, it found nothing OK. >You can also try and run Spybot, it looks for ad/spyware and may fix it. HiJackThis* >CW-Shredder* Spybot >Here's how to run it: > >How to Update Spybot > >1. Click on 'Online' in the navigation bar, >2. Click on 'Update', >3. Search for available updates, >4. Select ALL available updates, >5. Select a download location nearest to you, USA usually works the best. >6. Download the selected updates. >Updates will be installed without any further action needed. >Next, close all Internet Explorer windows, hit 'Check for Problems', and have SpyBot >remove/fix all it finds that are in RED > > You can also get a free virus check and fix - it may pick it up and isolate it - >give it a try. Panda >ActiveScan-VirusCheck > >Let me know, MrC > > > > > > > > [Reply or follow-up to this message] re: Now "Program has performed an illegal .... and will now shutdown" Tuesday, March 30, 2004 at 2:38 pm Posted by MrCharlie (4135 messages posted) Here's a couple of sites dealing with illegal operations, take a look at them. Illegal Operations Here Also You can also go to Start, Run, type msconfig, enter. Go to the startup tab and shut down programs that you don't need running and see if you can pin down what's causing the problem. You only need explorer and systray to run Windows. You can also use ctrl, alt, delete to end task on a program. When you get the error message, click on details and see what it says also. You can repair Internet Explorer by going to the add/remove programs in the Control panel and double click on IE and choose repair IE. On Tuesday, March 30, 2004 at 4:35 am, Levis wrote: >Thanks MrC, I have now been able to deal with the "fntldr.exe" problem when I installed >CWShredder and Spybot in Safe Mode. But another error is still destroying the computers >performance when you start the computer is normal mode. It's still bringing the error >"Program has performed an illegal operation and will now be shut down". You can't >surf without it bringing the error and it closes the browser. You also can't run >any application and I think this is a major problem or virus. What I'm I going to >do? It seems I can't run any program in normal mode and you know you are not able >to browse in safe mode. > > > [Reply or follow-up to this message] re: After I end the tasks in task manager..... Wednesday, March 31, 2004 at 4:58 am Posted by Levis (6 messages posted) Thanks again Mr. Charles. Now I can be able to run programs properly after I end the tasks in the task manager. The problem now is that I have to keep on ending the tasks everytime I start my computer. May be if I list the tasks that show, you will be able to tell me the actual task that I should completely remove from my computer so that I won't have to keep on ending them after start up. This are the programs (findfast, wzqkpick, explorer, Osa, Realplay, nscntrl, rundll, vptray, mdm, sdphotobar, mpeojmik, pgptray, jeijbqib). Pliz if you know the exact task help me out. Sorry for bothering. You have helped me alot and thanx again. On Tuesday, March 30, 2004 at 2:38 pm, MrCharlie wrote: > >Here's a couple of sites dealing with illegal operations, take a look at them. >Illegal Operations >Here Also > >You can also go to Start, Run, type msconfig, enter. Go to the startup tab and shut >down programs that you don't need running and see if you can pin down what's causing >the problem. You only need explorer and systray to run Windows. You can also use >ctrl, alt, delete to end task on a program. > >When you get the error message, click on details and see what it says also. > >You can repair Internet Explorer by going to the add/remove programs in the Control >panel and double click on IE and choose repair IE. > > > > [Reply or follow-up to this message] re: After I end the tasks in task manager..... Wednesday, March 31, 2004 at 5:42 pm Posted by MrCharlie (4135 messages posted) They keep coming back because you have to delete the executable files associated with them. Most of them are spy/adware. Your quickest and best bet is download HiJackThis, here's two links: CW-Shredder-Spybot-HJT HiJackThis and Instructions Then scan your system and save the log it creates. Create the log with everything running, nothing unchecked in the task manager, this is important so they can see everything that's running. Just tell them your problem and they will help you. You can post it here: TomCoyote.com HJT Forum. Don't you delete anything!! They are experts at doing this and there's always someone there to help you, they will stick and work with you until the problems are gone. It will be quicker then working with me because I'm only here a couple of hours a night and I don't know of anyone else qualified on this forum to help you. Let me know, if you want I will look at the HJT log but you will have to be patient. MrC ). On Wednesday, March 31, 2004 at 4:58 am, Levis wrote: >Thanks again Mr. Charles. Now I can be able to run programs properly after I end >the tasks in the task manager. The problem now is that I have to keep on ending the >tasks everytime I start my computer. May be if I list the tasks that show, you will >be able to tell me the actual task that I should completely remove from my computer >so that I won't have to keep on ending them after start up. This are the programs >(findfast, wzqkpick, explorer, Osa, Realplay, nscntrl, rundll, vptray, mdm, sdphotobar, >mpeojmik, pgptray, jeijbqib). Pliz if you know the exact task help me out. Sorry >for bothering. You have helped me alot and thanx again. > > > [Reply or follow-up to this message] re: Hijackthis log Wednesday, March 31, 2004 at 11:33 pm Posted by Levis (6 messages posted) This is the Hijackthis log I got from the scan. Logfile of HijackThis v1.97.7 Scan saved at 8:37:16 AM, on 4/1/04 Platform: Windows 95 B (Win9x 4.00.1111) MSIE: Internet Explorer v4.72 SP1 (4.72.3110.0000) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\MPREXE.EXE C:\PROGRAM FILES\NORTON ANTIVIRUS\RTVSCN95.EXE C:\PROGRAM FILES\NORTON ANTIVIRUS\DEFWATCH.EXE C:\WINDOWS\SYSTEM\MDM.EXE C:\PROGRAM FILES\NETWORK ASSOCIATES\PGP\IKESERVICE.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\RPCSS.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\PROGRAM FILES\REAL\REALPLAYER\REALPLAY.EXE C:\PROGRAM FILES\NORTON ANTIVIRUS\VPTRAY.EXE C:\WINDOWS\SYSTEM\NSCNTRL.EXE C:\WINDOWS\RunDLL.exe C:\SMARTDRAW PHOTO\SDPHOTOBAR.EXE C:\PROGRAM FILES\NETWORK ASSOCIATES\PGP\PGPTRAY.EXE C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE C:\WINDOWS\EXPLORER.EXE C:\NEW FOLDER\HIJACKTHIS.EXE R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.1.22:80 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 192.168. R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = F1 - win.ini: run=hpfsched O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [vptray] C:\Program Files\Norton AntiVirus\vptray.exe O4 - HKLM\..\Run: [nscntrl] c:\windows\system\nscntrl.exe /noconnect O4 - HKLM\..\Run: [SpybotSnD] "C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\SPYBOTSD.EXE" /autocheck O4 - HKLM\..\RunServices: [rtvscn95] C:\Program Files\Norton AntiVirus\rtvscn95.exe O4 - HKLM\..\RunServices: [defwatch] C:\Program Files\Norton AntiVirus\defwatch.exe O4 - HKLM\..\RunServices: [Machine Debug Manager] C:\WINDOWS\SYSTEM\MDM.EXE O4 - HKLM\..\RunServices: [IKEService95] C:\Program Files\Network Associates\PGP\IKEService.exe O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY O4 - HKCU\..\Run: [SDPhotoBar.exe] C:\SMARTD~2\SDPhotoBar.exe O4 - HKCU\..\Run: [sr64] C:\WINDOWS\SYSTEM\SR64\JEIJBQIB.EXE O4 - Startup: PGPtray.lnk = C:\Program Files\Network Associates\PGP\PGPtray.exe O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\MSACCESS.EXE O11 - Options group: [TB] Toolbar O12 - Plugin for .swf: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npswf32.dll O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll O13 - WWW. Prefix: http:// O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {22D6F312-B0F6-11D0-94AB-0080C74C7E95} (Windows Media Player) - http://activex.microsoft.com/activex/controls/mplayer/en/nsmp2inf.cab O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB O16 - DPF: {AD7FAFB0-16D6-40C3-AF27-585D6E6453FD} - http://66.230.143.209/loader/dploader.cab O16 - DPF: {C1C2AC28-5E4B-4228-B7A0-05E986FFCE14} (TIBSLoader Class) - http://www.movie-browser.com/tl4000.dll O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab On Wednesday, March 31, 2004 at 5:42 pm, MrCharlie wrote: > >They keep coming back because you have to delete the executable files associated >with them. Most of them are spy/adware. >Your quickest and best bet is download HiJackThis, here's two links: >CW-Shredder-Spybot-HJT >HiJackThis and Instructions >Then scan your system and save the log it creates. Create the log with everything >running, nothing unchecked in the task manager, this is important so they can see >everything that's running. Just tell them your problem and they will help you. You >can post it here: TomCoyote.com >HJT Forum. Don't you delete anything!! They are experts at doing this and there's >always someone there to help you, they will stick and work with you until the problems >are gone. It will be quicker then working with me because I'm only here a couple >of hours a night and I don't know of anyone else qualified on this forum to help >you. Let me know, if you want I will look at the HJT log but you will have to be >patient. MrC > > > > > > >). > > > > > > > > > > > [Reply or follow-up to this message] re: posted Hijackthis log Wednesday, March 31, 2004 at 11:42 pm Posted by Levis (6 messages posted) Hi Mr. Charles, I've just posted the hijackhis log to you and to tomcoyote.com. Thanks for everything you are doing. On Wednesday, March 31, 2004 at 5:42 pm, MrCharlie wrote: > >They keep coming back because you have to delete the executable files associated >with them. Most of them are spy/adware. >Your quickest and best bet is download HiJackThis, here's two links: >CW-Shredder-Spybot-HJT >HiJackThis and Instructions >Then scan your system and save the log it creates. Create the log with everything >running, nothing unchecked in the task manager, this is important so they can see >everything that's running. Just tell them your problem and they will help you. You >can post it here: TomCoyote.com >HJT Forum. Don't you delete anything!! They are experts at doing this and there's >always someone there to help you, they will stick and work with you until the problems >are gone. It will be quicker then working with me because I'm only here a couple >of hours a night and I don't know of anyone else qualified on this forum to help >you. Let me know, if you want I will look at the HJT log but you will have to be >patient. MrC > > > > > > >). > > > > > > > > > > > [Reply or follow-up to this message] re: posted Hijackthis log Thursday, April 1, 2004 at 3:13 pm Posted by MrCharlie (4135 messages posted) Good, I saw it over there, do what they tell you, you are in good hands . Let me know how it turns out. MrC On Wednesday, March 31, 2004 at 11:42 pm, Levis wrote: >Hi Mr. Charles, I've just posted the hijackhis log to you and to tomcoyote.com. Thanks >for everything you are doing. > > > [Reply or follow-up to this message] Tip: Use one of the [Reply or follow-up to this message] links above to add a message to this thread Search this forum Start a new thread on a different subject Report abuse of the forum Return to the Windows Me Discussion Forum