1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

[Resolved] Illegal Operations & blue screens

Discussion in 'Earlier Versions of Windows' started by Lori465, Jan 5, 2003.

Thread Status:
Not open for further replies.
Advertisement
  1. Lori465

    Lori465 Thread Starter

    Joined:
    Jan 5, 2003
    Messages:
    36
    I need lots of help, I am new to the board and am so very glad I have found this site.
    I have had problems for weeks now.
    I have a Compaq Presario 600 mhz, 7 gb, 184 mb Ram
    Running windows 98 2nd edition.
    I have been getting illegal operations on Iexplore and other programs this is just a few I have gotten this evening:

    Iexplore
    module (unknown) at 0000:0042b2b9
    module (unknown) at 0000:0042b629
    module oleaut32.dll at 0167:653aac21
    module mshtml.dll at 0167:7ae09e75
    module flash.ocx at 0167:1001d0a6

    Blue screen reading:

    Exception OD has occurred at 0028:00000038 in VxD

    I have been reading the forums and have tried the following with nothing but problems

    Cannot update windows at the microsoft site it gets half way through and freezes up.
    Cannot run virus scan at Panda site or house calls freezed up half way through...

    Can anyone help me.....that is a silly question....I know someone out there can and am sure they will need more info then I have posted here please let me know what else you need to diagnois my problem.

    I have tried to reinstall windows with no hope every time I do this I come up with the blue screen and it will not contiune I have also tried to repair Internet Explorer with the same problem

    I am sure I have a windows file missing or corrupted same as in explorer.

    I am thinking a virus but my avg will not detect it and I cannot download any other virus scans...

    Will be watching the board for any responses or solutions...

    Thanks !!!!!!!!
     
  2. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    Welcome to TSG, Lori.

    Many similar problems are caused by ad and spyware that get stealthily installed into many systems.

    We need to have a look at what you have running. To show us, download, unzip and run the StartupList.exe program from the site below. Then with the text file displayed, click Edit>Select All>Edit>Copy and paste the copied text to a message reply here.

    http://www.lurkhere.com/~nicefiles/

    And to save time, download, install and update Spybot following directions from the site below. But don't run it until you've gotten some feedback on your startups.

    http://tomcoyote.com/SPYBOT/
     
  3. Lori465

    Lori465 Thread Starter

    Joined:
    Jan 5, 2003
    Messages:
    36
    I thank you for your reply...
    I am trying to do as you say in between illegal operations.
    I had downloaded spybot like you said but am now unable to install it I get the following message : SET FILES ARE CORRUPTED...
    HELP
     
  4. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    Try this, go to start>run msconfig and clear the check for the "startup group" on the general page. If you can get back online, try running an online virus scan from one of these two sites:

    http://www.pandasoftware.com/activescan/

    http://housecall.antivirus.com/

    You can also try that spybot download again, but I fear you may have something like the "spaces" virus. Fortunately there may be a fixtool available that will work for it.

    And if you were able to download and unzip StartupList, please run and post that BEFORE disabling the startup group.
     
  5. Lori465

    Lori465 Thread Starter

    Joined:
    Jan 5, 2003
    Messages:
    36
    I have downloaded the spybot again and all I get is a document file.....
    I will try panda virus scan one more time but like I said in my first post it gets 1/4 the way through the scan and freezes .

    Then I will try the msconfig and will hopefully be back later to update you.

    If it is the spaces virus is there somewhere online I can go to get a removal tool for just that virus....??

    Thanks...
    Hope to be back soon.
     
  6. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    What I'd like is for you to disable startups under msconfig before running the online scan. That way it will eliminate any startup programs which could be causing interference. We really should have some confirmation on the problem before running a fix. Have you gotten the StartupList program downloaded? It would be very helpful to see that. Remember startups must be enabled for it to list them.
     
  7. NetEngineer

    NetEngineer

    Joined:
    Jan 6, 2003
    Messages:
    51
  8. Lori465

    Lori465 Thread Starter

    Joined:
    Jan 5, 2003
    Messages:
    36
    I went and disabled startup and ran virus scan again it worked this time it detected no viruses.
    Now I need to try and download the spybot again but it would not work the two times I tried but will try again and will reply back to you as soon as I get it done.
    The spybot will download but I only get a text document with alot of non-sense and then I go and find the file and when I click the setup it tells me there is a corrupted file..
     
  9. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    There are two different downloads on this page. One is a zip program and the other a self installing exe. Which one are you downloading and what extension does it have when you see the download window? does it have the same extension when it completes its download?

    http://www.lurkhere.com/~nicefiles/

    If you are downloading the zip one, try the other. If you are downloading the exe try the zip. You will need a zip program to unzip it. Then you install by running the enclosed exe.

    Have you tried to download and run the StartupList program? If you download it, re-enable your startups at least temporarily before running it. Then copy/paste the results here.
     
  10. Lori465

    Lori465 Thread Starter

    Joined:
    Jan 5, 2003
    Messages:
    36
    I downloaded the first one listed the document it named
    spybot11r3

    I will look for a different one to download....
     
  11. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    The first one is a ziped program like the Startup list. It sounds like you don't have an installed unzipping program like Winzip.

    The second download is better for you. It is a "self installing" exe.

    I'd recommend installing Winzip, but until we see what's going on, it's best not to do any major installs.

    Another option for you to post startups, is to download and run the StartLog.com file. Then copy/paste the logfile (but not the stubpaths.txt file) to a post.

    http://home.earthlink.net/~rmbox/Reticulated/4IE_Only/StartLog.com

    If you run Spybot, it should best be run with those problem startups disabled or run it in Safe Mode. If you run the StartLog.com file, you must enable startups first for them to be shown.
     
  12. Lori465

    Lori465 Thread Starter

    Joined:
    Jan 5, 2003
    Messages:
    36
    I have winzip, i have tried installing the zipped file and the startuplist file, but it still downloads a document file and not a setup file.....I am so very confused.
    I have the Lavasoft ad-ware program downloaded that I tried a week or so ago when I first started reading the forums here and before I even posted here would that program work?
    I am trying at this time to downloaded yet again the spybot.
    Why won't it download?
    Sorry to be such a pain.....
    but my computer is a pain to me right now, I have to reply and read in between illegal operations.....it is getting to be pretty sad on how fast I can surf without illegals popping up all the time...
     
  13. Del

    Del

    Joined:
    Aug 31, 2001
    Messages:
    3,452
    Go to Start > Find > Files or Folders and search your harddrive for a file called " wink*.*" without the quotes. If you find one, it's probably klez.h. Let us know what you find.
     
  14. Lori465

    Lori465 Thread Starter

    Joined:
    Jan 5, 2003
    Messages:
    36
    Finally after all the work I got it to work but now I have to figure out on how to copy and paste I am going by your directions and hope it works.......
    here it is..........

    StartupList report, 1/7/03, 10:57:51 PM
    StartupList version: 1.50
    Started from : C:\WINDOWS\TEMP\STARTUPLIST.EXE
    Detected: Windows 98 SE (Win9x 4.10.2222A)
    Detected: Internet Explorer v5.00 (5.00.2614.3500)
    * Using default options
    ==================================================

    Running processes:

    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\SYSTEM\MSTASK.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\TASKMON.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\WINDOWS\SYSTEM\WMIEXE.EXE
    C:\WINDOWS\SYSTEM\RNAAPP.EXE
    C:\WINDOWS\SYSTEM\TAPISRV.EXE
    C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
    C:\PROGRAM FILES\WINZIP\WINZIP32.EXE
    C:\WINDOWS\TEMP\STARTUPLIST.EXE

    --------------------------------------------------

    Autorun entries from Registry:
    HKLM\Software\Microsoft\Windows\CurrentVersion\Run

    ScanRegistry = C:\WINDOWS\scanregw.exe /autorun
    TaskMonitor = C:\WINDOWS\taskmon.exe
    LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    SystemTray = SysTray.Exe

    --------------------------------------------------

    Autorun entries from Registry:
    HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

    LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    SchedulingAgent = mstask.exe

    --------------------------------------------------

    Enumerating Active Setup stub paths:
    HKLM\Software\Microsoft\Active Setup\Installed Components
    (* = disabled by HKCU twin)

    [{89820200-ECBD-11cf-8B85-00AA005B4383}] *
    StubPath = C:\WINDOWS\SYSTEM\ie4uinit.exe

    [>PerUser_MSN_Clean] *
    StubPath = C:\WINDOWS\msnmgsr1.exe

    [PerUser_LinkBar_URLs] *
    StubPath = C:\WINDOWS\COMMAND\sulfnbk.exe /L

    [{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
    StubPath = "C:\Program Files\Outlook Express\setup50.exe" /APP:OE /CALLER:WIN9X /user /install

    [{7790769C-0471-11d2-AF11-00C04FA35D02}] *
    StubPath = "C:\Program Files\Outlook Express\setup50.exe" /APP:WAB /CALLER:WIN9X /user /install

    [{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}] *
    StubPath = C:\WINDOWS\SYSTEM\updcrl.exe -e -u C:\WINDOWS\SYSTEM\verisignpub1.crl

    [{44BBA840-CC51-11CF-AAFA-00AA00B6015C}.Restore]
    StubPath = rundll32.exe advpack.dll,UserUnInstStubWrapper {44BBA840-CC51-11CF-AAFA-00AA00B6015C}

    [{7790769C-0471-11d2-AF11-00C04FA35D02}.Restore]
    StubPath = rundll32.exe advpack.dll,UserUnInstStubWrapper {7790769C-0471-11d2-AF11-00C04FA35D02}

    [{89820200-ECBD-11cf-8B85-00AA005B4383}.Restore]
    StubPath = rundll32.exe advpack.dll,UserUnInstStubWrapper {89820200-ECBD-11cf-8B85-00AA005B4383}

    --------------------------------------------------

    Load/Run keys from C:\WINDOWS\WIN.INI:

    load=
    run=

    --------------------------------------------------

    Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

    Shell=Explorer.exe
    SCRNSAVE.EXE=C:\WINDOWS\SYSTEM\UNDERW~2.SCR
    drivers=mmsystem.dll

    --------------------------------------------------

    Checking for EXPLORER.EXE instances:

    C:\WINDOWS\Explorer.exe: PRESENT!

    C:\Explorer.exe: not present
    C:\WINDOWS\Explorer\Explorer.exe: not present
    C:\WINDOWS\System\Explorer.exe: not present
    C:\WINDOWS\System32\Explorer.exe: not present
    C:\WINDOWS\Command\Explorer.exe: not present

    --------------------------------------------------

    C:\WINDOWS\WININIT.BAK listing:
    (Created 4/1/2003, 19:37:2)

    [rename]
    C:\WINDOWS\FONTS\NELSPEC.TTF=C:\WINDOWS\FONTS\~GLH0016.TMP
    NUL=C:\WINDOWS\TEMP\GLB1A2B.EXE

    --------------------------------------------------

    C:\CONFIG.SYS listing:

    DEVICE=\SAMSUNG\SSCDROM.SYS /D:SSCD000

    --------------------------------------------------

    C:\WINDOWS\DOSSTART.BAT listing:

    C:\WINDOWS\COMMAND\MSCDEX.EXE /D:SSCD000 /M:10

    --------------------------------------------------

    Checking for superhidden extensions:

    .lnk: HIDDEN! (arrow overlay: yes)
    .pif: HIDDEN! (arrow overlay: yes)
    .exe: not hidden
    .com: not hidden
    .bat: not hidden
    .hta: not hidden
    .scr: not hidden
    .shs: HIDDEN!
    .shb: HIDDEN!
    .vbs: not hidden
    .vbe: *Registry key not found*
    .wsh: not hidden
    .scf: HIDDEN! (arrow overlay: NO!)
    .url: HIDDEN! (arrow overlay: yes)
    .js: not hidden
    .jse: *Registry key not found*

    --------------------------------------------------

    Enumerating Task Scheduler jobs:

    Tune-up Application Start.job

    --------------------------------------------------

    Enumerating Download Program Files:

    [Update Class]
    InProcServer32 = C:\WINDOWS\SYSTEM\IUCTL.DLL
    CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37625.8011342593

    [ActiveScan Installer Class]
    InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\ASINST.DLL
    CODEBASE = http://www.pandasoftware.com/activescan/as/asinst.cab

    [Shockwave Flash Object]
    InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX
    CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

    [HouseCall Control]
    InProcServer32 = C:\WINDOWS\DOWNLO~1\XSCAN53.OCX
    CODEBASE = http://a840.g.akamai.net/7/840/537/2002121801/housecall.antivirus.com/housecall/xscan53.cab

    --------------------------------------------------
    End of report, 5,816 bytes
    Report generated in 0.654 seconds

    Command line options:
    /verbose - to add additional info on each section
    /complete - to include empty sections and unsuspicious data
    /force9x - to include Win9x-only startups even if running on WinNT
    /forcent - to include WinNT-only startups even if running on Win9x
    /forceall - to include all Win9x and WinNT startups, regardless of platform
    /history - to list version history only
     
  15. Lori465

    Lori465 Thread Starter

    Joined:
    Jan 5, 2003
    Messages:
    36
    Del,
    I found "wink[1]" GIF Image Temp Internet files.
    What should I do with it?
     
  16. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/111604

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice