Boot Up Error Message

If you have "undeletable" coolsearch items, THEN you NEED to post within the sypware forums here at MG.

http://forums.majorgeeks.com/forumdisplay.php?f=35

But, first read and follow the following:

http://forums.majorgeeks.com/showthread.php?t=35407 <---- Excellent info on spyware removal, etc
and
http://forums.majorgeeks.com/showthread.php?t=38752 <--- Hijackthis log info....

 

Sorry, I'm getting sloppy in my responses---I'm a little punchy here. AS I was saying, I ran all of the programs in "Read this first" and the only thing that came up was Java Bytever A1. Trend House CAll found that.

 

Actually I did respond there. But when I came up with this problem this am, no one answered my problem. Thats why I came over here. I just checked a little while ago, and still no one had answered it. I posted it about 7:30 this am.

 

Since you only found one infection, doesn't mean there are more, I HIGHLY suggest to post in the spyware/virus forum: http://forums.majorgeeks.com/forumdisplay.php?f=35

Just to make sure you are virus/malware free. Just to be on the safe side.

 

You have four posts in the spyware forum, both Bjgarrick and Chaslang have replied to you and asked that you complete the steps they gave you. First post was yesterday at 00:18, second at 00:25, third at 23:44 and fourth today at 08:14; that would be local time where I am located. Neither Bjgarrick or Chaslang can assist yo if you don't follow through on their requests. Give me a moment, and I'll see if I can't get one of the guys over at the Spyware forum to help out.

 

Wow! Nice observation!

 

I'm a little confused as to where to go with questions. Anyway, regarding which forum to approach, I did as instructed regarding maleware by reviewing "read this first", ran all the scans and then was advised to scan with HJT and attach the log of results. Well, that is where this problem started regarding error messages, etc. I asked them for help yesterday, and when no one responded, I sought help here. In any event, i asked them about the following problem just now and they advised to come here. The item of concern is that I ran Registry Repair Pro a little while ago and it came up with 3655 invalid paths (yes, 3655). I didn't delete anything as I wanted to talk to you guys first. What do you recommend here? As a side note my registry seems to be clear of coolsearch crap. As always, thanks.

 

First I want you to run HijackThis, make sure it is installed at this loaction C:\Program Files\HijackThis, click-on Do a system scan and save a logfile. DO NOT FIX anything in HijackThis. Close the log file and exit HijackThis. Now post the log as an ATTACHMENT, DO NOT COPY & PASTE the log into your reply. The log will be located here C:\Program Files\HijackThis, you may have to change the extension from .log to .txt; if the log is to large to post then zip the file using ZipGenius.

I want to look through the log to make sure the system is clean of any malware before we continue with any fixes.

 

File attached.

 

The file didn't attach.

 

See attached.

 

see attached

 

It's not attaching either the file is too large or the file extension needs to be changed. There is a 97.5Kb file size limit. Open notepad and cut and paste half the file into a new file and save the orginal without the half you just pasted into a new document. Then post as 2 attachments.

 

The file is only 5.09Kb but we can't get it sent. Now when going back to locate the file in C:, it has disappeared. I don't know what to do.

 

Ok run HijackThis again, follow my previous instructions. This time PM me and Copy & Paste the file into the PM. The file will be in C:\Program Files\HijackThis.

 

I have to step out for awhile be back in about 30 minutes.

 

Send me the rest of the log. I need the whole thing.

 

I thought I sent the whole thing. Did you get 4 sections?

 

Take a look at the attached file. Is it the whole log?

Can you open Internet Explorer? Also download and install FireFox. If IE won't open uninstall it and install Internet Explorere 6 w/ SP1.

 

Can't open the log-Same error message Windows cannot find iexplorer.exe
I can open explorer from tool bar with no problem but not from icon on top desk top.

 

Firefox loaded!

 

You have AOL installed, do you still use it?
Do you use Netscape?
BellSouth is your ISP or was?

 

Only use BellSouth. Not sure whether I told you or not, but I did a reg. restore before talking with you trying to fix the boot up error message problem. Obviously, haven't had a chance to clean up reg yet.

 

Look in Add or Remove Programs in the control panel and unistall the following:

AOL
Netscape

If they aren't there don't worry about it.

PRINT THESE INSTRUCTIONS SO THAT YOU CAN OPERATE WITH ALL BOWSERS CLOSED

Run HijackTHis, this time just do a scan.

Have HijackThis fix the following lines:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by America Online
R3 - URLSearchHook: (no name) - _{6E6DD93E-1FC3-4F43-8AFB-1B7B90C9D3EB} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX (file missing)
O2 - BHO: BlspcHlpr Class - {15C9938F-CB96-496D-800A-B827F2E34EA1} - C:\PROGRAM FILES\BELLSOUTH INTERNET TOOLS\BLSPC.DLL (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - (no file)
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - (no file)
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\TOOLS\IESDPB.DLL (file missing)
O12 - Plugin for .qt: C:\Program Files\Netscape\Communicator\Program\PLUGINS\NPQTW32.DLL
O12 - Plugin for .mov: C:\Program Files\Netscape\Communicator\Program\PLUGINS\NPQTW32.DLL
O12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.aol.com

There should be nothing in Trusted Zones
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.awmdabest.com (HKLM)
O15 - Trusted IP range: 206.161.125.149
O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone

And Fix These
O16 - DPF: {22A88341-AFCB-45F0-A856-C2BAE74F878E} -
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = aoldsl.net
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 205.152.80.252,205.152.37.254

REBOOT Your computer

 

Only netscape removed-AOL not present. Not sure what you mean by "nothing should be in trusted zone". Should I remove anything in there? The rest I will do this AM as I've been up since 5 this morn. Hopefully you'll be around and feel like getting involved with this mess some more. Thanks again.

 

Trusted Zone is used by Internet Explorer and nothing should be in your trusted zone. Fix those entries. Good night, I'll be around sometime in the morning.

 

Good morning, Dude. Well, I did the fix to the items in HJT, but could no longer access the internet. So I just did a registry restore so at least I can talk with you. What do you recommend now.

 

I just took the registry back to 8/14 and the only change we did since then was remove Javasup.vxd.
I just now removed that so we should be back to where we were before the HJT fix.

 

Yes, I realize it is back. But if I were to do another fix, i can no longer access the internet. Is there something in Dude's removal items that should not be fixed? I guess I just don't want to go thru this again with someone new. Sorry for the trouble.

 

Please download HOSTER and then follow the below steps.

• Unzip Hoster to a convenient folder such as C:\Hoster

• Run Hoster.exe, click Restore Original Hosts and then click OK.
• Click the X to exit the program.

RUN the HJT fixes from my previous post.

Download and run WinSock XP Fix if you are unable to access the internet.

Reload any software drivers from Bellsouth if you are using DSL.

Uninstall Internet Explorer from Add or Remove Programs and run the IE6SETUP I had you download last night.

 

I access thru Explorer, ISP BellSouth. The message is "The page cannot be displayed".

 

Hi guys, Assuming the fix from HJT works this time (haven't done that yet), were would I be then? Do you know if I have any malware at this point? I'm wondering if it wouldn't be easier restoring the original set up on my '98 system rather then going thru all this. Most of what I'm doing here is quite new to me, and I guess I'm just not sure what I'm going to end up with. Again, many thanks for your help thus far. You've been great!

 

Your log does not show any malware, but does show remanents. When you can't connect to the internet, your hosts file, winsock, or firewall can cause the problem. After you follow my instructions try IE if it doen't connect try it with Firefox. If you still can't connect run Winsock XP Fix, reboot, try again, if that doesn't work disable your firewall and then try.

 

Something is amiss here. I just deleted just 1 item from the fix list (the last item, no. 17 ending with 254) and after reboot could not get to web. I tried both browsers with a disabled firewall and still couldn't get in. Also, I ran Winsock but still no luck. Restored no. 17 from fix and all is well again.

 

OK leave the O17 lines alone. Fix everything else.

 

From my observation, O17 relates to AOL DSL.

Jud149, are you getting DSL though AOL?

 

No, BellSouth, but I had AOL at one time.

 

Okay, I managed to delete all log items (save items no. 17 per advisement) except 015 - Trusted IP range: 206.161.125.149 ( will not delete) and have access to the internet. Two problems I know about at this point is that when attempting to open the items below, I get error messages as follows:

CCleaner run-time error 0
Window Washer \languages\English\dll

Now that I'm at this point, should I run any other programs or do anything, for that matter?

 

POST #46 did you install the VB6 Runtime

Uninstall and reinstall Window Washer

 

Another problem has arisen regarding getting to my home page. It is generally slow getting there, while surfing in general is normal. Other times "page cannot be displayed" comes up, and sometimes you're taken to Google IE page. And still other times 'Windows cannot find iexplore comes up.

 

Adding to the above, I just noticed that Google Tool Bar for IE has been added to my add/remove program listing. Could this be the culprit?

 

Did you uninstall adn reinstall IE6 like I asked? No the Google toolbar is not causing the problem. What have you installed since I asked you to install the VB6 Runtime?

 

I'm guilty Dude, but I have tried. I've downloaded it into a C:temp file and when I go to find it, it's not there. Is there another way for me to install this sucker? This is the only one I seem to have trouble with.

 

Save the file to your desktop. That way you don't have to go looking for it.

 

Installation of that seems to have solved the problem nicely. One thing though; if you double click on the IE icon, you get "windows cannot find iexplore. Yet when I go thru "open", home page comes right up. Also, should I remove that Google tool bar for IE. It wasn't there previously. Thanks. BTW, I'm gonna leave you alone for awhile, which I'm sure you're glad to hear.

 

You can uninstall the google toolbar if you want. THe desktop shortcut doesn't point to the correct target file. We'll fix that later. surf around see if what's working, what's not then come back later and we'll fix whatever else neeeds to be fixed.

 

You are the man!

 

We are always happy to help out. No need to think you are bothering us. Issues like these are not only a learning experience for you, it is also for us. So, when these issues crop up for another person, we may be able to resolve them quicker!

 

Hi Dude, With the exception of one item, my system seems to be running very well, thanks to you. The problem I'm having is that I cannot open MS Word 2000. Message is "the feature u r trying to use is on CD-Rom or other removable disk that is not available". After closing window, message is "error 1706-no valid source could be found for product MS Word 2000. The Windows installer cannot continue".

 

Your experiencing a Windows Installer error. Install Version 2 of Windows Installer.

http://www.microsoft.com/downloads/...d8-c094-4255-b702-de3bb768148f&displaylang=en

If it is already installed on your system unistall it then install the one above.

Then run the installer for MS Office or Word which ever one you have and select run all from hard drive. That way it will never ask you for your Office/Word CD again.