1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

error messages

Discussion in 'Earlier Versions of Windows' started by confused 2, Jan 6, 2002.

Thread Status:
Not open for further replies.
Advertisement
  1. confused 2

    confused 2 Thread Starter

    Joined:
    Jan 6, 2002
    Messages:
    8
    hello I'm new here a friend told me about this site . I think its a cool site..
    I have been getting error messages for a while now. I cant seem to figure them out was wondering if someone could help please I'm running windows 98 (se) the errors are as follows:

    A fatal exception OE has occurred at 0028:00000002

    A fatal exception 06 at 0177:BFF7A128

    A exception OE has occurred at 0028:C175DC86 in VxD AAFVXD (01) + 00001636.this was called from 0028:C001C0D4 in VXD NDIS (01)+ 0004620. It may be possible to continue normally.

    at start up got this one a few times : A fatal exception OE occurred at 0177:BFF83BEA


    I know this is asking a lot but any help would be greatly appreciated...

    here is what I think is my start up programs ( I hope) LOL



    __________________________________________________________________________
    __________________________________________________________________________

    Startup Log Index

    1. HKLM Run
    2. HKCU Run
    3. HKLM RunOnce
    4. HKCU RunOnce
    5. HKLM RunServices
    6. HKLM RunServicesOnce
    7. WIN.INI file
    8. SYSTEM.INI file
    9. AUTOEXEC.BAT file
    10. StartUp folder
    11. All Users StartUp
    12. Misc. StartUp Configurations

    __________________________________________________________________________
    __________________________________________________________________________

    The following is a list of your current Start-Ups
    __________________________________________________________________________
    __________________________________________________________________________

    1. HKLM Run - Registry

    [RegPath]
    "StartUp"


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ScanRegistry"="c:\\windows\\scanregw.exe /autorun"
    "TaskMonitor"="c:\\windows\\taskmon.exe"
    "SystemTray"="SysTray.Exe"
    "LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
    "FontFix"="c:\\windows\\options\\systools\\fntfix.exe"
    "Multimedia Keyboard"="C:\\Program Files\\Mediascape\\Multimedia Keyboard\\MMKeybd.exe"
    "OnScreen Display"="C:\\Program Files\\Mediascape\\OnScreen Display\\OSD.exe"
    "Tweak UI"="RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp"
    "CyberTrioModeInfo"="C:\\CyberTrio\\ShowMode.exe"
    "SystemWizard Sniffer"="C:\\Program Files\\Common Files\\SystemSoft\\sniffer.exe"
    "Warner"="C:\\Warner\\Warner.exe"
    "NPROTECT"="C:\\Program Files\\Norton SystemWorks\\Norton Utilities\\nprotect.exe"
    "NAV DefAlert"="C:\\PROGRA~1\\NORTON~1\\NORTON~2\\DEFALERT.EXE"
    "Norton Auto-Protect"="C:\\PROGRA~1\\NORTON~1\\NORTON~2\\NAVAPW32.EXE /LOADQUIET"
    "Norton eMail Protect"="C:\\Program Files\\Norton SystemWorks\\Norton AntiVirus\\POPROXY.EXE"


    I have a 40 gig hard drive and 64 mgs of ram ..
    If I was to install more ram might this help and if so how much can I install? does any of this effect my bios ?

    sorry for posting so much at once ..
    any help would be great thank you ..... confused 2
     
  2. TonyKlein

    TonyKlein Malware Specialist

    Joined:
    Aug 26, 2001
    Messages:
    10,392
    Hi Confused 2,

    It's only a tiny part of your startups, actually.

    Would you mind posting the whole thing, please?
     
  3. Davey7549

    Davey7549

    Joined:
    Feb 28, 2001
    Messages:
    11,584
    Confused2
    Of course post the full list as Tony suggests however the error message suggests your problem is related to communication network error. I suspect the AAfvxd should actually be AFVxd coupled with Ndis suggests above.

    A exception OE has occurred at 0028:C175DC86 in VxD AAFVXD (01) + 00001636.this was called from 0028:C001C0D4 in VXD NDIS (01)+ 0004620. It may be possible to continue normally.

    Are you getting these errors at startup? Or do they occur when you are running a certian program such as a game? Any further clarification would help. Do you have a PC camera hooked up?
    Dave
     
  4. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    I used to get the exact same AFVXD error periodically (several times a week for awhile), usually when closing the modem connection. Except mine were always called from PPPMAC, not NDIS.

    Haven't had one in months since using the System File Checker to restore the afvxd.vxd


    Using SFC to extract files

    1. Go to Start>Run and enter SFC and click OK
    2. Check "Extract one File"
    3. Enter the file name and click on "Start"
    4. In the "Restore from" field enter:: D:\WIN98 [if 'D' is not the letter of your CD-Rom drive, modify appropriately]
    5. Click OK

    {if you do not have a Windows system CD, try subsitituting c:\windows\options\cabs in the"restore from field"}
     
  5. confused 2

    confused 2 Thread Starter

    Joined:
    Jan 6, 2002
    Messages:
    8
    heres complete start up Tony


    ---------- C:\WINDOWS\desktop\StartUp.Log

    Start-Ups checked at 01-06-2002 5:02:35.18p
    __________________________________________________________________________
    __________________________________________________________________________

    StartUp Log for Windows 95/98 - Freeware by rmbox
    __________________________________________________________________________
    __________________________________________________________________________

    Comments:

    This is a log of all the programs on your computer that
    are starting automatically every time you start Windows.
    Using this log can be a quick way to spot trojans.

    StartUp Log (version 1.54) - Release Date 12/12/2001

    __________________________________________________________________________
    __________________________________________________________________________

    StartUp Log Index

    1. HKLM Run
    2. HKCU Run
    3. HKLM RunOnce
    4. HKCU RunOnce
    5. HKLM RunServices
    6. HKLM RunServicesOnce
    7. WIN.INI file
    8. SYSTEM.INI file
    9. AUTOEXEC.BAT file
    10. StartUp folder
    11. All Users StartUp
    12. Misc. StartUp Configurations

    __________________________________________________________________________
    __________________________________________________________________________

    The following is a list of your current Start-Ups
    __________________________________________________________________________
    __________________________________________________________________________

    1. HKLM Run - Registry

    [RegPath]
    "StartUp"


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ScanRegistry"="c:\\windows\\scanregw.exe /autorun"
    "TaskMonitor"="c:\\windows\\taskmon.exe"
    "SystemTray"="SysTray.Exe"
    "LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
    "FontFix"="c:\\windows\\options\\systools\\fntfix.exe"
    "Multimedia Keyboard"="C:\\Program Files\\Mediascape\\Multimedia Keyboard\\MMKeybd.exe"
    "OnScreen Display"="C:\\Program Files\\Mediascape\\OnScreen Display\\OSD.exe"
    "Tweak UI"="RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp"
    "CyberTrioModeInfo"="C:\\CyberTrio\\ShowMode.exe"
    "SystemWizard Sniffer"="C:\\Program Files\\Common Files\\SystemSoft\\sniffer.exe"
    "Warner"="C:\\Warner\\Warner.exe"
    "NPROTECT"="C:\\Program Files\\Norton SystemWorks\\Norton Utilities\\nprotect.exe"
    "NAV DefAlert"="C:\\PROGRA~1\\NORTON~1\\NORTON~2\\DEFALERT.EXE"
    "Norton Auto-Protect"="C:\\PROGRA~1\\NORTON~1\\NORTON~2\\NAVAPW32.EXE /LOADQUIET"
    "Norton eMail Protect"="C:\\Program Files\\Norton SystemWorks\\Norton AntiVirus\\POPROXY.EXE"


    ==========================================================================
    __________________________________________________________________________

    2. HKCU Run - Registry

    [RegPath]
    "StartUp"


    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    @=""
    "ComTry Web Searcher"="C:\\Program Files\\ComTry Web Searcher\\wstray.exe"
    "Weather"="C:\\PROGRAM FILES\\AWS\\WEATHERBUG\\WEATHER.EXE 1"


    ==========================================================================
    __________________________________________________________________________

    3. HKLM RunOnce - Registry

    [RegPath]
    "StartUp"


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
    "CydoorUpdate"="RunDll32 C:\\WINDOWS\\SYSTEM\\AdCache\\Temp\\cd_clint.dll,ServiceRunDll v"


    ==========================================================================
    __________________________________________________________________________

    4. HKCU RunOnce - Registry

    [RegPath]
    "StartUp"


    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]


    ==========================================================================
    __________________________________________________________________________

    5. HKLM RunServices - Registry

    [RegPath]
    "StartUp"


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
    "LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
    "HOTKEY"="C:\\PROGRA~1\\NAV\\hotkey.exe /AUTO /BAR"
    "NPROTECT"="C:\\Program Files\\Norton SystemWorks\\Norton Utilities\\nprotect.exe"
    "SymTray - Norton SystemWorks"="C:\\Program Files\\Common Files\\Symantec Shared\\SymTray.exe \"Norton SystemWorks\""
    "ScriptBlocking"="\"C:\\Program Files\\Common Files\\Symantec Shared\\Script Blocking\\SBServ.exe\" -reg"
    "Tweak UI"="RUNDLL32.EXE TWEAKUI.CPL,TweakLogon"
    "TrueVector"="C:\\WINDOWS\\SYSTEM\\ZONELABS\\VSMON.EXE -service"
    "MiniLog"="C:\\WINDOWS\\SYSTEM\\ZONELABS\\MINILOG.EXE -service"


    ==========================================================================
    __________________________________________________________________________

    6. HKLM RunServicesOnce - Registry

    [RegPath]
    "StartUp"


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]


    ==========================================================================
    __________________________________________________________________________

    7. WIN.INI File - (c:\windows\win.ini)

    Your win.ini run/load lines should look like run= and load= exclusively.
    There should be nothing to the right of the equal signs.


    These are the run and load lines in your WIN.INI file

    run=c:\windows\options\systools\cyxid98.exe hpfsched
    OldRun=c:\windows\options\systools\cyxid98.exe hpfsched

    load=

    ==========================================================================
    __________________________________________________________________________

    8. SYSTEM.INI File - (c:\windows\system.ini)

    Your system.ini shell line should look like shell=Explorer.exe exclusively.
    You should only see Explorer.exe following the equal sign.


    This is the shell line in your SYSTEM.INI file

    shell=Explorer.exe

    ==========================================================================
    __________________________________________________________________________

    9. AUTOEXEC.BAT File - (c:\autoexec.bat)

    (Some trojans have been known to start from this file)


    These are your program startups and set paths in your autoexec.bat file

    @ECHO OFF
    WINDOWS\OPTIONS\SYSTOOLS\DOSMODE

    SET BLASTER=A220 I5 D1 T4

    ==========================================================================
    __________________________________________________________________________

    10. StartUp Folder - (c:\windows\start menu\programs\startup)

    Shortcuts to any program will automatically start when placed here.


    These are the shortcuts located in your StartUp folder

    *(No start-ups found)*

    ==========================================================================
    __________________________________________________________________________

    11. All Users Folder - (c:\windows\all users\start menu\programs\startup)

    Shortcuts to any program will automatically start when placed here.


    These are the shortcuts located in your All Users StartUp folder

    C:\WINDOWS\All Users\Start Menu\Programs\StartUp\ZoneAlarm.lnk

    ==========================================================================
    __________________________________________________________________________

    12. Miscellaneous StartUp Configurations

    -============================-
    Registry StartUp Directories
    -============================-

    Should show the Start Menu StartUp and All Users StartUp directories

    .....................................................................

    [1] HKCU - Shell Folders

    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

    "Startup"="C:\\WINDOWS\\Start Menu\\Programs\\StartUp"

    .....................................................................

    [2] HKCU - User Shell Folders

    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders


    .....................................................................

    [3] HKLM - Shell Folders

    HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders

    "Common Startup"="C:\\WINDOWS\\All Users\\Start Menu\\Programs\\StartUp"

    .....................................................................

    [4] HKLM - User Shell Folders

    HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\User Shell Folders


    .....................................................................

    -=======================-
    Registry Shell Spawning
    -=======================-

    Open Commands for Executable File Types

    @="\"%1\" %*"
    (.exe file - RegPath = HKCR\exefile\shell\open\command)

    @="\"%1\" %*"
    (.com file - RegPath = HKCR\comfile\shell\open\command)

    @="\"%1\" /S"
    (.scr file - RegPath = HKCR\scrfile\shell\open\command)

    @="\"%1\" %*"
    (.bat file - RegPath = HKCR\batfile\shell\open\command)

    @="\"%1\" %*"
    (.pif file - RegPath = HKCR\piffile\shell\open\command)

    @="C:\\WINDOWS\\SYSTEM\\MSHTA.EXE \"%1\" %*"
    (.hta file - RegPath = HKCR\htafile\shell\open\command)

    -=========================-
    HKLM RunOnceEx - Registry
    -=========================-


    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx]


    -=========================-
    HKU (.Default) Run - Registry
    -=========================-


    [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Run]
    @=""
    "ComTry Web Searcher"="C:\\Program Files\\ComTry Web Searcher\\wstray.exe"
    "Weather"="C:\\PROGRAM FILES\\AWS\\WEATHERBUG\\WEATHER.EXE 1"


    -==============================-
    HKU (.Default) RunOnce - Registry
    -==============================-


    [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\RunOnce]


    -================================-
    StubPaths - Registry (Partial Listing)
    -================================-

    (Please see the StubPath.txt on your desktop for complete listing)

    HKLM\Software\Microsoft\Active Setup\Installed Components


    "RealStubPath"="C:\\WINDOWS\\SYSTEM\\IE4UINIT.EXE"
    "OldRealStubPath"="C:\\WINDOWS\\SYSTEM\\IE4UINIT.EXE"
    "StubPath"="c:\\windows\\COMMAND\\sulfnbk.exe /L"
    "RealStubPath"="\"C:\\PROGRA~1\\OUTLOO~1\\setup50.exe\" /APP:OE /CALLER:IE50 /user /install"
    "OldRealStubPath"="\"C:\\PROGRA~1\\OUTLOO~1\\setup50.exe\" /APP:OE /CALLER:IE50 /user /install"
    "StubPath"=""
    "OldStubPath"="\"C:\\PROGRA~1\\OUTLOO~1\\setup50.exe\" /APP:WAB /CALLER:IE50 /user /install"
    "RealStubPath"="\"C:\\PROGRA~1\\OUTLOO~1\\setup50.exe\" /APP:WAB /CALLER:IE50 /user /install"
    "StubPath"="C:\\WINDOWS\\SYSTEM\\updcrl.exe -e -u C:\\WINDOWS\\SYSTEM\\verisignpub1.crl"

    -=================-
    DOSSTART.BAT File - (c:\windows\dosstart.bat)
    -=================-

    @ECHO OFF
    GOTO MSDOS
    [MSDOS]
    :MSDOS
    C:\WINDOWS\setupds.exe /S
    LH C:\WINDOWS\OPTIONS\SYSTOOLS\DEVICE.COM C:\WINDOWS\OPTIONS\SYSTOOLS\OAKCDROM.SYS /D:MSCD0001
    LH C:\WINDOWS\COMMAND\MSCDEX.EXE /D:MSCD0001 /L:Q /M:20
    LH /L:1,61856 C:\WINDOWS\OPTIONS\SYSTOOLS\MOUSE.COM
    C:\WINDOWS\OPTIONS\SYSTOOLS\DEVICE.COM C:\WINDOWS\OPTIONS\SYSTOOLS\Power.exe



    -=========================-
    ICQ Inet Registry StartUp
    -=========================-

    Shows applications that start when connected to Inet


    [HKEY_CURRENT_USER\Software\Mirabilis\ICQ\Agent\Apps]
    "Launch Browser"="No"


    -=====================-
    Screen Saver Settings (Possible system.ini start-up)
    -=====================-


    ==========================================================================
    __________________________________________________________________________

    - Supplemental Environment Information -

    TMP=c:\windows\TEMP
    TEMP=C:\windows\TEMP
    winbootdir=C:\WINDOWS
    PATH=C:\WINDOWS;c:\windows;c:\windows\COMMAND
    COMSPEC=C:\WINDOWS\COMMAND.COM
    windir=C:\WINDOWS


    ==========================================================================
    __________________________________________________________________________

    - End -

    I get these errors usually when starting or shutting down
     
  6. TonyKlein

    TonyKlein Malware Specialist

    Joined:
    Aug 26, 2001
    Messages:
    10,392
    You have some serious spyware there, plus some stuff routinely responsible for causing errors, and slowing your machine down.
    Let's remove all unnecessary and harmful stuff from startup.

    First you have something like cyxid98.exe starting up from your Win.Ini file.
    It could well be a virus or trojan.

    Go to Start/Run, type Win.in, and Click OK.

    You'll see 2 lines:

    run=c:\windows\options\systools\cyxid98.exe hpfsched
    OldRun=c:\windows\options\systools\cyxid98.exe hpfsche

    Edit them, deleting what's in it, so that the first one reads run= only, and delete the second one (Oldrun) altogether.
    Now save in 'File', and close your Win ini

    Now, go to Start/run, and type msconfig.
    On the Startup tab, uncheck EVERYTHING, EXCEPT for the following items

    "ScanRegistry"=
    "SystemTray"=
    "LoadPowerProfile"=
    "Multimedia Keyboard"=(optional)
    "SystemWizard Sniffer"=(optional)
    "NPROTECT"=" (optional)
    "NAV DefAlert"="
    "Norton Auto-Protect"=
    "Norton eMail Protect"=
    LoadPowerProfile"=
    "SymTray -
    "ScriptBlocking"
    "Tweak UI"="RUNDLL32.EXE TWEAKUI.CPL,TweakLogon"
    "TrueVector"="
    "MiniLog"="

    Click OK, close Msconfig, and reboot (important!)

    The items marked 'optional' aren't neccessary for Windows to run either, and you may experiment later by unchecking them as well.

    Now download and install Ad-Aware . This is a program which scans your system for spyware.

    After having downloaded AAW, also download the latest Signature file (Reflist.sig) : http://www.lavasoftusa.net/aaw/binary/reflist.zip
    Unpack it to the Lavasoft Ad-Aware folder in Program Files, and have it overwrite the one that's there.

    Then have your drives and registry scanned for spyware, check all found files and reg keys, click continue, and have them removed.
    Reboot one last time.

    Now have your system scanned on line at <A HREF="http://housecall.antivirus.com/">Trend Micro HouseCall </A>

    Good luck,
     
  7. confused 2

    confused 2 Thread Starter

    Joined:
    Jan 6, 2002
    Messages:
    8
    ok tony I did every thhing you said to do so far , Im now at the point of deleteing the spy were . My Question is do I delet ever thing it has on the list or do I keep some of the windows stuff???
    Sorry for being such a duff......Just dont want to go doing anything wrong :)
     
  8. TonyKlein

    TonyKlein Malware Specialist

    Joined:
    Aug 26, 2001
    Messages:
    10,392
    Ad-Aware only recognizes files and registry keys associated with spyware, and everything it finds can be deleted.
    One caveat are Web3000 files.
    If you have those, you need to uninstall the application they came with first.
    NewNet is another one, but if you installed the reflist update like I advised you to do, this one won't even be there.

    However, if it makes you feel a little more secure, Ad-Aware does have a backup function.

    Back everything up, have it removed, and make sure you reboot immediately afterwards.

    Good luck,
     
  9. confused 2

    confused 2 Thread Starter

    Joined:
    Jan 6, 2002
    Messages:
    8
    Thanks Tony for all your help I really appreciate it ....

    would you beable to tell me if I was to add ram to my comp how large I can go I have a 40 GIG hd. and would this help comp run better???

    Thanks for all your help
     
  10. TonyKlein

    TonyKlein Malware Specialist

    Joined:
    Aug 26, 2001
    Messages:
    10,392
    What amount of RAM do you presently have?

    It all depends what you use your machine for.
    Unused RAM is wasted RAM.

    Generally speaking, if you have 256 MB RAM, you're unlikely to run into trouble.
    Other people might be entirely happy with 64 or 128 MB, and yet others need more.

    But to return to your original problem: Did you scan on line at House Call?
    And what was the verdict?
     
  11. confused 2

    confused 2 Thread Starter

    Joined:
    Jan 6, 2002
    Messages:
    8
    hey Tony scanning with house call now ... I have 64 ram now I get message every now and then that my virtual memory is ful???? Will let you know what scan says .. thanks again for all your help .. I love this board
     
  12. confused 2

    confused 2 Thread Starter

    Joined:
    Jan 6, 2002
    Messages:
    8
    Tony ,
    scan done says it didnt find anything . (thank god ) LOL
     
  13. TonyKlein

    TonyKlein Malware Specialist

    Joined:
    Aug 26, 2001
    Messages:
    10,392
    Great! :)

    As for your Virtual Memory errors, If you'd have the exact error message for us that would help.

    You could do 2 things to start with:

    1) Go to "Start" then "Settings" then "Control Panel" Then go to"Performance" then "Virtual Memory". Your system is probably going to have the "Let Windows manage my virtual memory settings" button marked.
    If it isn't, then someone has gotten to your system to change this setting for some reason, and you should restore it.

    To quote James Eshelman: "There are dozens of recommendations on ways to optimize it just a bit (some of which I use, and perpetuate, myself), but these are so system-dependent that it would take a huge article to explain all the ifs, ands, and buts of one approach over another in a particular situation. These discussions occur quite regularly online, on peer-support and general discussion newsgroups, so it is not hard to find opinions."

    2) Click Start , point to Find , and then click Files or Folders .

    In the Named box, type win386.swp .

    In the Look in box, click Drive C , and then click Find Now .

    Right-click the Win386.swp file, click Properties , and then make sure the Read-only check box is NOT ticked.

    Click Apply , and then click Close .

    If you can't find the file it may be hidden.
    Go to Folder Options/View, and make sure 'Show all files' is checked.

    Good luck,
     
  14. confused 2

    confused 2 Thread Starter

    Joined:
    Jan 6, 2002
    Messages:
    8
    Tony ,
    checked every thing is like you said it should be ...

    Thank you so much for all your help...
     
  15. TonyKlein

    TonyKlein Malware Specialist

    Joined:
    Aug 26, 2001
    Messages:
    10,392
    You're welcome :)
     
  16. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/64403

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice