Missing or corrupted: DEVICE=C:\WINDOWS\EMM386.EXE

[genesis2003]

Learn as you go person needs help!

Lately I’ve been experiencing some problems with my computer. At times the computers refuses to shut down properly, the “shutting down” Windows screen just stays on, and the only way to resolve it is to turn the computer off at the switch.

While using my Net Objects Fusion 3.0 “Preview” button to check out some of my project layouts, both Netscape and Internet Explorer, at times, refuses to open up. Also my Net Objects Fusion “Help Topics”, and both of my Adobe Illustrator 8 and Photoshop 5&6 “index and “Quick reference” functions will not open.

On occasion while using my Adobe programs, my desktop file icons changes and only comes back to its original state after I have shut the computer off and restart it.

All the programs still function well except the anomalies mentioned, but my computer acts like it’s running on ½ of the RAM available.

I defrag my computer about once a month, but today I came into something unusual.

At start up, hoping to log on to Safe Mode to do a defrag, I pressed the spacebar at the Compaq intro, in between and during the window start up.

On the top of the screen, I received the following what appeared to be written in DOS with a black background:

"The following file is missing or corrupted: DEVICE=C:\WINDOWS\EMM386.EXE
There is an error in your Config.sys line 2. "

There were more items, but the rest of the description appeared to be a systems check with no other warnings.

I went into "Start-up", opened "Run", and typed in "msconfig".

In System Configuration Utility, under the "Config.sys" tab the second line is checked off and reads:

DEVICE=C:\WINDOWS\EMM386.EXE
; --- SB PCI mod --- DEVICE=C:\WINDOWS\HIMEM.SYS

What does it mean, does this have anything to do with the anomalies I’ve been experiencing, do I need to be concerned, and if so how do I fix it?

History: A few months ago I had an error message come up when I attempted to enter into my Internet Explorer control panel. The message read, "Cannot find the file 'c:\windows\rundll32.exe' (or one of its components). Make sure the path and filename are correct and that all required libraries are available." I went ahead and used this advice:

----------------------------
If you're running Win 98, you can do this very easily with System File Checker:

Go to Start/run, and type SFC.
Choose 'Extract One File From Installation Disk'.
Type rundll32.exe, not worrying about its location. Then, click Start.

Next to 'Restore From', type in or browse for the file’s location, which is probably in the Win98 folder of your installation CD-ROM (typically D:\Win98), or in your Windows\Options\Cabs folder, as the case may be.

Then, next to 'Save File In', enter C:\Windows, and click OK. System File Checker looks for the file, saves it as you requested, and then tells you that 'the file has been successfully extracted'.

Now reboot, and try again.
-----------------------------

This fixed just the rundll32.exe problem!

Computer: Compaq Presario 7AP140 (7000 Series)
800MHz AMD Athlon Processor
128MB Memory
30.0GB Hard Drive
OS: Windows 98se
Norton Antivirus 2003 (use consistent since purchased new)

Note: Physical memory available to windows 130,500
Systems Resources 54%

Please advise!

Thanks

 

[BTS '76]

that emm386.exe is your expanded memory, You may have to reload the operating system.

I'm sure there's another way to get it, but not sure what that way is.

sounded like you may have had a virus, but you said you run Norton alot.

 

[Rollin' Rog]

In plain fact Windows does not need either config.sys or autoexec.bat to load.

You could just disable the entire file.

However to correct the error, replace the two lines you just referenced with:

DEVICE=C:\WINDOWS\HIMEM.SYS
DEVICE=C:\WINDOWS\EMM386.EXE



>> the device....himem.sys line must be First.

To make the edit, go to start>run and enter sysedit and select the config.sys file. Make the change and close the file, accepting the changes.

Also, let's have a look at your overall configuration: Go to the site below and download, unzip and run the StartupList application.

Then copy/paste the results to a reply here.

http://www.lurkhere.com/~nicefiles/

>> For the shutdown problem, try this first: go to start>run, enter msconfig and click on the Advanced tab. Put a check in "Disable Fast Shutdown"

You may need to install the Win98SE shutdown supplement if that doesn't help.

 

[genesis2003]

Rollin' Rog

Thanks for the advice regarding,

DEVICE=C:\WINDOWS\HIMEM.SYS
DEVICE=C:\WINDOWS\EMM386.EXE

The changes were made as you suggested!

Regarding the Shutdown problem suggestion, I’ve attempted to locate the "Disable Fast Shutdown" as you suggested, but could not find it on the list. Here’s the list that it does shows under the “Advance” tab:

Disable System Rom Breakpoint
Disable Virtual IRO
EMM Exclude A000-FFFF
Force Compatibility mode disk access
VGA 640x480x16
Use SCSI Double-buffering (This one is checked, and appears inaccessible)
Enable Startup Menu
Disable Scandisk after shutdown
Limit memory to 128MB
Disable UDF file system
Enable Pentium FO (Lock CmpXchg) workaround

Here’s the Startup list information you asked for:

StartupList report, 2/9/03, 7:44:34 AM
StartupList version: 1.51
Started from : C:\UNZIPPED\STARTUPLIST151\STARTUPLIST.EXE
Detected: Windows 98 SE (Win9x 4.10.2222A)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MDM.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\WINDOWS\SYSTEM\HIDSERV.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\CPQEADM.EXE
C:\WINDOWS\SYSTEM\LVCOMS.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\ptsnoop.exe
C:\PROGRAM FILES\TEXTBRIDGE PRO 9.0\BIN\INSTANTACCESS.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\BTTNSERV.EXE
C:\WINDOWS\LOADQM.EXE
C:\IMAGEMATE COMPACTFLASH USB\SANDICON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\ADAPTEC\DIRECTCD\DIRECTCD.EXE
C:\PROGRAM FILES\COMPAQ\DIGITAL DASHBOARD\DEVGULP.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\EAUSBKBD.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\WINDOWS\STARTER.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKCALREM.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\OPLIMIT\OCRAWARE.EXE
C:\OPLIMIT\OCRAWR32.EXE
C:\PROGRAM FILES\TEXTBRIDGE PRO 9.0\BIN\EREG\REMIND32.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
F:\WINZIP32.EXE
C:\UNZIPPED\STARTUPLIST151\STARTUPLIST.EXE

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\WINDOWS\Start Menu\Programs\StartUp]
Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
OCRAWARE.lnk = C:\OPLIMIT\OCRAWARE.EXE
Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
3DO Registration.lnk = C:\Program Files\TextBridge Pro 9.0\Bin\Ereg\Remind32.exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
CPQEASYACC = C:\Program Files\Compaq\Easy Access Button Support\cpqeadm.exe
EACLEAN = C:\Program Files\Compaq\Easy Access Button Support\eaclean.exe
LexStart = Lexstart.exe
LexmarkPrinTray = PrinTray.exe
DXM6Patch_981116 = C:\WINDOWS\p_981116.exe /Q:A
LVComs = c:\windows\SYSTEM\LVComS.exe
MacLicense = "C:\Program Files\MacOpener\MacLic.exe"
StillImageMonitor = C:\WINDOWS\SYSTEM\STIMON.EXE
CountrySelection = pctptt.exe
PTSNOOP = ptsnoop.exe
InstantAccess = C:\PROGRA~1\TEXTBR~1.0\BIN\INSTAN~1.EXE /h
RegisterDropHandler = C:\PROGRA~1\TEXTBR~1.0\BIN\REGIST~1.EXE
McAfeeWebScanX = C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\WebScanX.exe
LoadQM = loadqm.exe
SandIcon = C:\ImageMate CompactFlash USB\SandIcon.Exe
SystemTray = SysTray.Exe
Adaptec DirectCD = C:\PROGRA~1\ADAPTEC\DIRECTCD\DIRECTCD.EXE
ScanRegistry = c:\windows\scanregw.exe /autorun
Digital Dashboard = C:\Program Files\Compaq\Digital Dashboard\DevGulp.exe
NAV CfgWiz = c:\PROGRA~1\NORTON~1\CFGWIZ.EXE /R
ccApp = c:\Program Files\Common Files\Symantec Shared\ccApp.exe
ccRegVfy = c:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe
internat.exe = internat.exe
TkBellExe = C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot
EnsoniqMixer = starter.exe
Welcome = C:\WINDOWS\Welcome.exe /R

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

Hidserv = Hidserv.exe run
RegisterDropHandler = C:\PROGRA~1\TEXTBR~1.0\BIN\REGIST~1.EXE
Machine Debug Manager = C:\WINDOWS\SYSTEM\MDM.EXE
SchedulingAgent = mstask.exe
ccEvtMgr = c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
ScriptBlocking = "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

AIM = C:\PROGRAM FILES\AIM95\aim.exe -cnetwait.odl
msnmsgr = "C:\WINDOWS\DESKTOP\JONATHANS STUFF\STARCRAFT\MSN MESSENGER\MSNMSGR.EXE" /background
NSCheck = C:\WINDOWS\SYSTEM\NSCHECK.EXE /boot
OSSProxy = C:\WINDOWS\SYSTEM\OSSPROXY.EXE

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 8/2/2003, 20:14:56)

[Rename]
NUL=c:\windows\cusnns.bak
NUL=c:\windows\cookies\[email protected][1].txt
NUL=c:\windows\cookies\[email protected][4].txt
NUL=c:\windows\cookies\[email protected][5].txt
NUL=c:\windows\cookies\[email protected][5].txt
NUL=c:\windows\cookies\[email protected][4].txt
NUL=c:\windows\cookies\[email protected][2].txt
NUL=c:\windows\cookies\[email protected][1].txt
NUL=c:\windows\cookies\[email protected][4].txt
NUL=c:\windows\cookies\[email protected][2].txt
NUL=c:\windows\cookies\[email protected][2].txt
NUL=c:\windows\cookies\[email protected][1].txt
NUL=c:\windows\cookies\[email protected][4].txt
NUL=c:\windows\cookies\[email protected][4].txt
NUL=c:\windows\cookies\[email protected][1].txt
NUL=c:\windows\cookies\[email protected][1].txt
NUL=c:\windows\cookies\[email protected][3].txt
NUL=c:\windows\cookies\[email protected][2].txt
NUL=c:\windows\cookies\[email protected][1].txt
NUL=c:\windows\cookies\[email protected][2].txt
NUL=c:\windows\cookies\[email protected][3].txt
NUL=c:\windows\cookies\[email protected][3].txt
NUL=c:\windows\cookies\[email protected][2].txt
NUL=c:\windows\cookies\[email protected][2].txt
NUL=c:\windows\cookies\[email protected][1].txt
NUL=c:\windows\cookies\[email protected][1].txt
NUL=c:\windows\cookies\[email protected]www.qksrv[1].txt
NUL=c:\windows\cookies\[email protected][1].txt
NUL=c:\windows\cookies\[email protected][1].txt
NUL=c:\windows\cookies\[email protected][2].txt
NUL=c:\windows\cookies\[email protected][1].txt
NUL=c:\windows\cookies\[email protected][1].txt
NUL=c:\windows\cookies\[email protected][1].txt
NUL=c:\windows\cookies\[email protected][2].txt
NUL=c:\windows\cookies\[email protected][1].txt
NUL=c:\windows\cookies\[email protected][1].txt
NUL=c:\windows\cookies\[email protected][1].txt
NUL=c:\windows\cookies\[email protected][2].txt
NUL=c:\windows\cookies\[email protected][2].txt
NUL=c:\windows\cookies\[email protected][2].txt
NUL=c:\windows\cookies\[email protected][1].txt
NUL=c:\windows\cookies\[email protected][1].txt
NUL=c:\windows\cookies\[email protected][1].txt
NUL=c:\windows\cookies\[email protected][1].txt
NUL=c:\windows\cookies\[email protected][2].txt
NUL=c:\windows\cookies\[email protected][2].txt
NUL=c:\windows\cookies\[email protected][2].txt
NUL=c:\windows\cookies\[email protected][2].txt
NUL=c:\windows\cookies\[email protected][2].txt
NUL=c:\windows\cookies\[email protected][1].txt
NUL=c:\windows\cookies\[email protected]www.qksrv[2].txt
NUL=c:\windows\cookies\[email protected][2].txt
NUL=c:\windows\cookies\[email protected][1].txt
NUL=c:\windows\cookies\[email protected][2].txt
NUL=c:\windows\cookies\[email protected]www.qksrv[1].txt
NUL=c:\windows\cookies\[email protected][2].txt
NUL=c:\windows\cookies\[email protected][1].txt
NUL=c:\windows\cookies\[email protected][1].txt
NUL=c:\windows\downloaded program files\nsconfig.dll
NUL=c:\windows\temp\ccu\comet.exe
NUL=c:\windows\temp\ccu\skinui.dll
NUL=c:\windows\temp\ccu\csietb.dll
NUL=c:\windows\temp\ccu\cseng.dll
NUL=c:\windows\temp\ccu\csctx.dll
NUL=c:\windows\temp\ccu\cscore.dll
NUL=c:\windows\temp\ccu\csbho.dll
NUL=c:\windows\temp\ccu\csband.dll
NUL=c:\windows\system\csloa.dl__
NUL=c:\windows\system\nscheck.exe
NUL=c:\windows\system\csloa.dll
NUL=c:\dialler.log
NUL=c:\windows\system\ossproxy.exe

--------------------------------------------------

C:\AUTOEXEC.BAT listing:

c:\PROGRA~1\NORTON~1\NAVDX.EXE /startup
SET CLASSPATH=C:\Program Files\PhotoDeluxe 2.0\AdobeConnectables
SET BLASTER=A220 I7 D1 H7 P330 T6
SET SBPCI=C:\SBPCI

--------------------------------------------------


Enumerating Browser Helper Objects:

(no name) - C:\WINDOWS\SYSTEM\NZDD.DLL - {EBCDDA60-2A68-11D3-8A43-0060083CFB9C}
NAV Helper - c:\Program Files\Norton AntiVirus\NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Symantec NetDetect.job
Synchronize Time.job
Check E-mail.job

--------------------------------------------------

Enumerating Download Program Files:

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[InstallFromTheWeb ActiveX Control]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\IFTW.DLL
CODEBASE = http://www.installfromtheweb.com/install/iftwclix.cab

[MailConfigure Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\MAILCFG.DLL
CODEBASE = http://supportservices.msn.com/us/smtptool/MailCfg.cab

[CV3 Class]
InProcServer32 = C:\WINDOWS\SYSTEM\WUV3IS.DLL
CODEBASE = http://windowsupdate.microsoft.com/R1024/V31Controls/x86/w98/en/actsetup.cab

[nsBrowserConfig Class 2]
InProcServer32 = C:\WINDOWS\DOWNLO~1\NSCONFIG.DLL
CODEBASE = https://www.marketscore.com/globalconfig/nsconfig.cab

[NSUpdateLiteCtrl Class]
InProcServer32 = C:\WINDOWS\SYSTEM\NSUPDATE.DLL
CODEBASE = http://204.177.92.201/quickdl/proclaim/NSupd9x.cab

[{A1DC3241-B122-195F-B21A-000000000000}]
CODEBASE = http://pluginaccess.com/Browser_Plugin.cab

--------------------------------------------------

Enumerating Winsock LSP files:

Protocol #1: CSLOA.DLL (file MISSING)
Protocol #2: CSLOA.DLL (file MISSING)
Protocol #3: CSLOA.DLL (file MISSING)
Protocol #4: CSLOA.DLL (file MISSING)
Protocol #5: CSLOA.DLL (file MISSING)
Protocol #11: CSLOA.DLL (file MISSING)

--------------------------------------------------
End of report, 11,059 bytes
Report generated in 0.297 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

I thought I deleted all the cookies out of my IE, what’ all this!

Again, thanks for your input!

 

[Rollin' Rog]

Genesis... the reason Disable Fast Shutdown would not be there is if you have already installed the SE Shutdown supplement. It might be a good idea to verify if you still have a valid installation for it.

To check, go to start>run and enter qfecheck

Under the Win98SE tree you should see an entry for q239887. If you expand that, you should see individual files listed and whether the versions are valid.

========

We are probably going to have to solve the shutdown problem and others by trimming that startup list quite a bit.

For starters you have two antivirus programs running Nav2003 and an older McAfee:

>> McAfeeWebScanX = C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\WebScanX.exe

I would recommend that you remove McAfee completely. I would also not have NAV running anything from startup in the Autoexec.bat file:

>>c:\PROGRA~1\NORTON~1\NAVDX.EXE /startup

====================

The next stage is to get rid of this interloper (marketscore ad proxy installation):

NSCheck = C:\WINDOWS\SYSTEM\NSCHECK.EXE /boot
OSSProxy = C:\WINDOWS\SYSTEM\OSSPROXY.EXE

>> Try this first: Close out Internet Explorer and your net connection, then go to start>run and enter:

NSCheck /uninstall

Reboot afterwards and see if those entries are still there. If they are, I would recommend installing, updating and running Spybot, which should get rid of it. Accept all the Spybot updates except for Language Tools and PGP.

http://tomcoyote.org/SPYBOT/

This is a vital program to have installed in any case.
=================================
You should also go to Internet Options > Settings > View Objects and remove these two items related to the above marketscore install:

[nsBrowserConfig Class 2]
InProcServer32 = C:\WINDOWS\DOWNLO~1\NSCONFIG.DLL
CODEBASE = https://www.marketscore.com/globalconfig/nsconfig.cab

[NSUpdateLiteCtrl Class]
InProcServer32 = C:\WINDOWS\SYSTEM\NSUPDATE.DLL
CODEBASE = http://204.177.92.201/quickdl/proclaim/NSupd9x.cab

================================

Now I imagine that even at this point your shutdown problem is going to remain since you have so much funky stuff in that startuplist. By the way, when you have to do a forced shutdown, don't switch off the power. Instead, press and hold the power button down on the tower for 5-8 seconds. This is a safer method and invokes the BIOS shutdown procedure.

To troubleshoot further we need to do as "clean" a boot as possible, and then gradually re-enable files.

To do a "clean boot", run msconfig, and uncheck everything on the startup tab except the following basic files:

ScanRegistry
Systray

When re-enabling things, you should probably start with the symantec files first.

I would recommend leaving these unchecked permanently:

LoadQM = loadqm.exe

Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe

Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

3DO Registration.lnk = C:\Program Files\TextBridge Pro 9.0\Bin\Ereg\Remind32.exe

NAV CfgWiz = c:\PROGRA~1\NORTON~1\CFGWIZ.EXE /R

Adaptec DirectCD = C:\PROGRA~1\ADAPTEC\DIRECTCD\DIRECTCD.EXE

Welcome = C:\WINDOWS\Welcome.exe /R

Machine Debug Manager = C:\WINDOWS\SYSTEM\MDM.EXE

================

You can review what most of these are, and others as well, using this link:

http://www.lafn.org/webconnect/mentor/startup/PENINDEX.HTM

===========

If you asking what all those cookies listed in your wininit.bak file are, they were removed. The wininit.bak file is a renamed wininit.ini file which some programs use to accomplish tasks that cannot be done from within Windows. When it has completed successfully, it is renamed wininit.bak.

 

[genesis2003]

Rollin' Rog

Thanks again for your input!

I enter qfecheck as you suggested and found Win98.SE and saw the q239887and expanded it and saw:

MSCONFIG>EXE 4.10.0.2223
PCI.VXD 4.10.0.2223
AMPBATT>SYS 4.10.0.2223
VPOWERD>VXD 4.10.0.2223

On each of these, to the left side, had the window icons; I guess it’s not associating with and particular program?

=====================

I went ahead and checked off C:\PROG~1\NORTON~\NAVDX>EXE/startup located in the Autoexec.bat.file

No McAfee related items were found in my ADD/REMOVE program file. I tried locating the file under Windows Explorer but couldn’t find c:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\WebScanX.exe

I ran Start>Find>File or Folder, I look for any McAfee files under My Computer and found some files located on c:\cpqs folder. Should I delete any McAfee related items in that folder? Is there somewhere else to find this stuff that I don’t know about?

================================

Re:

NSCheck = C:\WINDOWS\SYSTEM\NSCHECK.EXE /boot
OSSProxy = C:\WINDOWS\SYSTEM\OSSPROXY.EXE

I tried Start>run and enter: NSCheck/unistall, but the computer could not run this because couldn’t find the file.

I haven’t yet attempted to download the Spybot program you suggested. I did download, before submitting all this material, Ad-ware 6.0 Spybot program which I heard suggested by Jeff Levy on the radio. I ran it, but wasn’t sure what to do with the info it generated, so I just exited out without deleting or quarantine anything.

====================================

I could only find Internet Options located in my Control Panel, no “Setting” folder tab was found. Instead Internet Properties with related folder tabs was opened, but no “Setting” was found. Again, am I looking for this in the right spot?

Again, thanks for your input!

 

[Rollin' Rog]

Your files for the Win98SE shutdown patch look to be in order, so there is nothing further you need to do there.

We can just remove the startup for that McAfee application from the registry. To do that, click Start>Run and enter regedit

Navigate to:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

By clicking the + signs beside each entry in the file tree. Select (Highlight) the RUN folder and look in the Right hand pane for

McAfeeWebScanX = C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\WebScanX.exe

Just right click on that and delete it. Don't delete anything else from the run folder. If you've disabled it (unchecked it) first in Msconfig, it will be found in the Run- folder nearby.

I haven't installed the new Ad-Aware; I guess I'm going to have to do that and have a look. The old one gave the option to backup any removals before proceeding. Typically you could just select all entries it found. If problems resulted you could restore the backup.

Did it detect Marketscore and ossproxy among what it listed?

Finally the Downloaded Programs folder can be found by clicking Tools > Internet Options. Then under "Delete Temporary Internet
Files" you will see a "settings" tab and under that "view objects". That's the folder.

 

[genesis2003]

Oops, forgot to mention this.

I forgot to add this to my last response.

I went ahead and the clean boot as you suggested, I checked off everything except:

ScanRegistry
System Tray

clicked “Applied” and “Oked”. Restart was initialized, and I noticed an EQ icon in my start up tray. I went ahead and checked the “startup tab” in msconfig, and these items were found checked.

ScanRegistry c:\windows\scanregw.exe/autorun
System Tray systray.exe
Country Selection pctptt.exe
PTSNOOP ptsnoop.exe
EnsoniqMixer starter.exe

Again, I checked off:

Country Selection pctptt.exe
PTSNOOP ptsnoop.exe
EnsoniqMixer starter.exe

And again it came back, is this something to be concerned about?
Frankly, I like to get rid of that EQ icon, I never seem to use it anyways.

When re-enabling things, how will I know what and when to re-enable?

Thanks!
-----------

PS, your last responce was quick, I appreciate it!

 

[VirtualMe]

Here is what Adaware help says.

Working with the quarantine-manager



Moving objects into quaratine..

Quarantine-files are used to isolate and backup items detected during the scan, giving you an option to reinstall them at a later time.
Items moved to the quarantine folder will be encrypted and compressed, and can only be read and restored using the built in quarantine-manager.
Any of the objects from the Ad-aware result list can be quarantined, including registry keys, values, data as well as files and folders.

You can quarantine a particular system by selecting all objects belonging to the associated Vendor using the "Quarantine selection" option from the Result-list pop up menu.Eventually enter a name for the archive and click "ok" to create it.

Note: For details about the result-list menu features, see "Scan results"

You can create as many quarantine-files as you desire.For each quarantine-file created, a log will be created and merged to the archive.

The quarantine-log can be viewed from within the quarantine-manager by either double-clicking on the quarantine-file or selecting it and
clicking the "Contains" button.



Quarantine Objects (backups) screen options
You can edit the quarantine-list either by using the right-click pop-up menu, or by the three buttons below the list.
The three lower buttons have the following functions :

· Contains - Displays the quarantine log, containing the names of all of the objects included in the archive.

· Delete - Deletes the selected archive.

· Restore - Reinstalls the content from the selected archive to their original location prior to deletion.



Note : double-click on an archive in the list to view its quarantine-log

Each item in the list features four parameters which are :

· File name - Date, and quarantine #. Quarantine-archives are saved with the .bckp extension.

· Size - Total size of the all objects within the quarantine-archive.

· Creation Date - Month, day, and year on which the quarantine-archive was created.

· Objects Total - Total number of objects within the quarantine-archive.



The total amount of all quarantined objects is shown on the Ad-aware status screen.
If you reset your usage stastics, your quarantine-archives will not be deleted.

Right click in the quarantine-list to open the quarantine-list menu.
The following options are available:

· Item details - Displays the quarantine log, containing the names of all of the objects included in the archive.

· Reinstall - Reinstalls the content from the selected archive to their original location prior to deletion.

· Delete archive - Deletes the selected archive.

· Delete all archives - Deletes all quarantine-archives at once.

· Help - Opens the Ad-aware 6 user manual.





--------------------------------------------------------------------------------

Working with the quarantine-manager:


1. Creating quarantine-archives automatically (Auto-backup)




Open Ad-aware,

Click the "Settings" quick launch button at the top right of the interface,

Click "General",

Check "Automatically quarantine objects prior to removal",

Click "Proceed".



Note: An automatically created archive will contain a remark in the file-name, and the time and date when it has been created.





2. Creating quarantine-archives manually




When the Ad-aware scan is complete;

Select the items you wish to quarantine,

Click "Quarantine",

Enter a filename for the archive,

Click "OK".





3. Viewing all of the items within a quarantine-archive




To view all entries within individual quarantined items, open the quarantine manager from the "Status" screen.

Click "Status",

Click on "View quarantined objects".

To return to the status-screen, click 'Status'.





4. Reinstalling/restoring quarantined-objects





If you wish to re-install components you previously removed using Ad-aware, open the quarantine manager from the

'Status' screen.

Click 'Status',

Click on 'View quarantined objects'.

Click on the item in the list that you want to restore,

Click 'Contains' to verify that the selected item is the desired item to restore,

Click 'Restore',

Click 'OK'.

To return to the status-screen, click 'Status'.





5. Deleting quarantine-archives




To delete quarantined items, open the quarantine manager from the 'Status' screen.

Click 'Status',

Click on 'View quarantined objects'.

Click 'Contains' to verify that the selected item is the desired item for deletion,

Click 'Delete',

Click 'OK'.

To return to the status-screen, click 'Status'.

 

[Rollin' Rog]

Well I just got back from installing and running the new version. Sure takes long time to complete on XP and really doesn't belong scanning in the restore archive or dllcache folders. But no matter. It looks to be pretty fail-safe to use.

Unlike the older version which required you to manually select "backup", the new version configures "quarantine" to automatically run, and this backs up the files. If you want to reinstall you open the quarantine folder and click "restore" for the selected archive.

My run found all of 14 "objects". 13 of them were just tracking cookies and I removed those. The remaining was an Alexa registry entry. Since I understand this to be a default key in later IE versions, I did not remove it. I think it just gets recreated anyway.

You are most likely safe if you just let it remove everything.

About the EQ icon. Was that there previously? I'd suspect it is for the Ensonique Mixer\starter.exe (equalizer function). You can't get rid of Ensonique's Start.exe. It will just keep coming back when unchecked.

You can double click the EQ icon to see what it opens.

Did Windows shutdown normally in that minimal startup config?

The order in which you re-enable things isn't all that important, but I would recheck all the symantec related entries at one time.

I would leave unchecked the entries I mentioned in a previous post. If you leave Stimon unchecked you would have to run it manually to use your scanner, so eventually you will need that.

 

[VirtualMe]

See if you have the option to disable Ensonique's Start.exe icon this way.

go to start/control panel/system
click device manager
click sound video and game controllers
click soundblaster audio pciXX
click properties
click settings
uncheck add mixer icon to taskbar

 

[Rollin' Rog]

Actually there is another way I know of to disable it. I was getting it confused with SBlive's devldr.exe which is more troublesome.

Whether it's worth the effort I don't know, but see Whitphil's post here:

http://forums.techguy.org/showthread.php?postid=285545#post285545

VirtualMe's way would certainly be easiest if it works, but I don't know if it keeps starter.exe out of msconfig.

 

[genesis2003]

Rollin Rog,

Thanks again!!!!!

The Windows shutdown appears normal in that minimal startup config.

I went ahead and checked off:

CcEvtMgr
Scriptblocking

Which have the Symantec info you suggested.

I also checked off:

StillImageMonitor

Which has the Stimon info for my scanner.

I haven’t had a chance to do much more today, but I will tackle the rest of this tomorrow (Tuesday 11th).

I want to thank not only Rollin Rog, but VirtualMe and BTS’76 for all your help so far!

 

[Rollin' Rog]

Okedoke, that's good to hear. I would also promptly enable these two Symantec files, as they are a part of the NAV2003 set:

ccApp = c:\Program Files\Common Files\Symantec Shared\ccApp.exe

ccRegVfy = c:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe

 

[genesis2003]

Again, thanks for the advise!!

Well here's the latest scoop..

I entered regedit, and I’m trying to locate HKLM\Software\Microsoft\Windows\CurrentVersion\Run, however I see only the items listed:

HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_CURRENT_CONFIG
HKEY_DYN_DATA

Am I missing a turn somewhere?

==============================

Good News!! Located in the “view Objects” folder I finally got rid of:

[nsBrowserConfig Class 2]
InProcServer32 = C:\WINDOWS\DOWNLO~1\NSCONFIG.DLL
CODEBASE = https://www.marketscore.com/globalconfig/nsconfig.cab

[NSUpdateLiteCtrl Class]
InProcServer32 = C:\WINDOWS\SYSTEM\NSUPDATE.DLL
CODEBASE = http://204.177.92.201/quickdl/proclaim/NSupd9x.cab

=============================

RE: Ad-ware 6.0

I ran the program, 83 items were found, and I went ahead and removed them all except the Alexa entry.

When I attempted to get on the net, I got connected at 115,100bps, bytes received 1260, and bytes sent 2242.
My Browser would not connect me; the only way I could get on was to restore all the 83 quarantined objects.

This happened the first time I tried running this program prior to submitting all this material, it kind of freaked me out at the time.

Here’s the info that was stated in the Quarantine file prior to restore:

ArchiveData(auto-quarantine- 11-02-2003 17-30-40.bckp)
============================================

COMETCURSOR
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
obj[0]=RegKey : CLSID\{6F2D6A5E-E3E7-4F18-887C-C777650DEF57}
obj[1]=RegKey : CLSID\{7F0F5DA7-84CB-11D4-8137-00500487B1C5}
obj[2]=RegKey : CLSID\{827A2ECE-D76F-4BCC-82ED-D6A287C11211}
obj[3]=RegKey : CLSID\{A335D52F-D489-472D-9EAA-D72A40AAF7CA}
obj[4]=RegKey : CLSID\{C38FC998-3B1B-4F59-A710-5A6C9CF8BD92}
obj[12]=RegValue : Software\Microsoft\Windows\CurrentVersion\SharedDLLs
obj[16]=File : c:\windows\temp\ccu\csband.dll
obj[17]=File : c:\windows\temp\ccu\csbho.dll
obj[18]=File : c:\windows\temp\ccu\cscore.dll
obj[19]=File : c:\windows\temp\ccu\csctx.dll
obj[20]=File : c:\windows\temp\ccu\cseng.dll
obj[21]=File : c:\windows\temp\ccu\csietb.dll
obj[22]=File : c:\windows\temp\ccu\skinui.dll
obj[23]=File : c:\windows\temp\ccu\comet.exe

MARKETSCORE(NETSETTER)
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
obj[5]=RegKey : Interface\{F88527E2-A8A7-4227-8683-05CFA4EEC511}
obj[6]=RegKey : Nsconfig.nsBrowserConfig.2
obj[8]=RegKey : Software\Netsetter
obj[9]=RegKey : Software\Netsetter
obj[14]=File : c:\windows\system\csloa.dll
obj[15]=File : c:\windows\system\csloa.dl__
obj[82]=File : c:\windows\cusnns.bak

DIALER
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
obj[7]=RegKey : SOFTWARE\Microsoft\Code Store Database\Distribution Units\{A1DC3241-B122-195F-B21A-000000000000}
obj[10]=RegKey : Software\SiteIcons
obj[11]=RegKey : Software\SiteIcons
obj[13]=File : c:\dialler.log

TRACKING COOKIE
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
obj[24]=File : c:\windows\cookies\[email protected][1].txt
obj[25]=File : c:\windows\cookies\[email protected][1].txt
obj[26]=File : c:\windows\cookies\[email protected][2].txt
obj[27]=File : c:\windows\cookies\[email protected]www.qksrv[1].txt
obj[28]=File : c:\windows\cookies\[email protected][2].txt
obj[29]=File : c:\windows\cookies\[email protected][1].txt
obj[30]=File : c:\windows\cookies\[email protected][2].txt
obj[31]=File : c:\windows\cookies\[email protected]www.qksrv[2].txt
obj[32]=File : c:\windows\cookies\[email protected][1].txt
obj[33]=File : c:\windows\cookies\[email protected][2].txt
obj[34]=File : c:\windows\cookies\[email protected][2].txt
obj[35]=File : c:\windows\cookies\[email protected][2].txt
obj[36]=File : c:\windows\cookies\[email protected][2].txt
obj[37]=File : c:\windows\cookies\[email protected][2].txt
obj[38]=File : c:\windows\cookies\[email protected][1].txt
obj[39]=File : c:\windows\cookies\[email protected][1].txt
obj[40]=File : c:\windows\cookies\[email protected][1].txt
obj[41]=File : c:\windows\cookies\[email protected][1].txt
obj[42]=File : c:\windows\cookies\[email protected][2].txt
obj[43]=File : c:\windows\cookies\[email protected][2].txt
obj[44]=File : c:\windows\cookies\[email protected][2].txt
obj[45]=File : c:\windows\cookies\[email protected][1].txt
obj[46]=File : c:\windows\cookies\[email protected][1].txt
obj[47]=File : c:\windows\cookies\[email protected][1].txt
obj[48]=File : c:\windows\cookies\[email protected][2].txt
obj[49]=File : c:\windows\cookies\[email protected][1].txt
obj[50]=File : c:\windows\cookies\[email protected][1].txt
obj[51]=File : c:\windows\cookies\[email protected][1].txt
obj[52]=File : c:\windows\cookies\[email protected][2].txt
obj[53]=File : c:\windows\cookies\[email protected][1].txt
obj[54]=File : c:\windows\cookies\[email protected][1].txt
obj[55]=File : c:\windows\cookies\[email protected]www.qksrv[1].txt
obj[56]=File : c:\windows\cookies\[email protected][1].txt
obj[57]=File : c:\windows\cookies\[email protected][1].txt
obj[58]=File : c:\windows\cookies\[email protected][2].txt
obj[59]=File : c:\windows\cookies\[email protected][2].txt
obj[60]=File : c:\windows\cookies\[email protected][3].txt
obj[61]=File : c:\windows\cookies\[email protected][3].txt
obj[62]=File : c:\windows\cookies\[email protected][2].txt
obj[63]=File : c:\windows\cookies\[email protected][1].txt
obj[64]=File : c:\windows\cookies\[email protected][2].txt
obj[65]=File : c:\windows\cookies\[email protected][3].txt
obj[66]=File : c:\windows\cookies\[email protected][1].txt
obj[67]=File : c:\windows\cookies\[email protected][1].txt
obj[68]=File : c:\windows\cookies\[email protected][4].txt
obj[69]=File : c:\windows\cookies\[email protected][4].txt
obj[70]=File : c:\windows\cookies\[email protected][1].txt
obj[71]=File : c:\windows\cookies\[email protected][2].txt
obj[72]=File : c:\windows\cookies\[email protected][2].txt
obj[73]=File : c:\windows\cookies\[email protected][4].txt
obj[74]=File : c:\windows\cookies\[email protected][1].txt
obj[75]=File : c:\windows\cookies\[email protected][2].txt
obj[76]=File : c:\windows\cookies\[email protected][4].txt
obj[77]=File : c:\windows\cookies\[email protected][5].txt
obj[78]=File : c:\windows\cookies\[email protected][5].txt
obj[79]=File : c:\windows\cookies\[email protected][4].txt
obj[80]=File : c:\windows\cookies\[email protected][1].txt
obj[81]=File : c:\windows\cookies\[email protected]www.qksrv[3].txt

Ok, what did I do wrong?

Should I dump this program and try your suggestion instead > http://tomcoyote.org/SPYBOT/

Thanks again!!!!