[Resolved] Problems after Adaware, Spybot, & HiJackThis mntc

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

shoff

Thread Starter
Joined
Nov 13, 1999
Messages
153
We had been noticing an hourglass running more often than usual and thought it might have been a browser hijacker. So we ran Adaware, Spybot, and HiJack this.
Afterwards, (the hourglass STILL running too oftern ! )
SEVERAL problems have appeared:

1. Some of My MSOffice 2000 Programs are not working Properly:
A: My Excel and Powerpoint want to be installed (!) I can't open either one at all.
B: My FrontPage Express displays the following error message:
Box 1= Error starting Program -
The FPCUTL.DLL file is
linked to missing export MFC42.DLL:6880
Box 2= C:\Program Files\Microsoft Office\Office\FRONTPAGE.exe
A device attached to the system is not functioning.
How do I restore the MFS42.DLL:6880 file? I have an MFC42.DLL file but it doesn't show the :6880 - what is that?
(PS: My Word, Access, Photo Editor, and Outlook seem to be working fine.)

2. When I put my Office 2000 CD in to re-install them, My computer will not recognize my CD drive. I get the following message:
Q:\ is not accessible
The device is not ready
I had a situation a yr and 1/2 ago where my CD rom drive disappeared because of a Microsoft update I did, and was told to do a scanreg /restore and select yesterday's date. Which I did - and I was able to see my CD rom drive
So I did that again today for yesterday's date. But now I have already 5 backup registry files so I can't see the latest one to select it at start up.
How can I access my new backup registry to see if that will restore my CD Rom functionality?

3. I still do not know how to find out what is causing the hourglass to appear so often - what is running?

I am totally stumped - PLEASE HELP!

Thanks
S Hoff

Packard Bell AMD K6 2 Processor with Windows98 and Office 2000.
 
Joined
Dec 9, 2000
Messages
45,855
The problem with the MFC42.DLL:6880 is not that you don't have mfc42.dll, but that it is not the version being looked for.

Do a complete file search for mfc42.dll and right click on each and select Version. What is the version number and location of each? Typically the highest version should be in windows\system and there should be no others in the path.

You cannot tell if a particular backup will repair a problem. You can choose one of the first 4 (or in some cases the 5th if certain precautions are taken). If the date precedes the problem there is a good chance it will fix it. But this is less advisable if programs have been uninstalled after that date as their registry entries will be restored. Installed programs will have their registry entries removed, but their files will still remain on the system. This is less of a problem.

And you might want to provide us with a copy/paste of a current HijackThis Scanlog so we can see what is actually running. Be sure to use the latest version of the program.

http://www.tomcoyote.org/hjt/

You may be able to resolve your mfc42.dll problem by installing this "libraries update" which contains a compatible set of files:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;197298
 

shoff

Thread Starter
Joined
Nov 13, 1999
Messages
153
Thank you for your response Rollin Rog
I have tried to follow your instructions but am still having the same problems - so maybe you can provide me with some more ideas


1--- I downloaded the latest version of the Hijack detecter just
now, and here is the log:
----------------------------------------------------

Logfile of HijackThis v1.97.2
Scan saved at 9:57:07 AM, on 10/7/03
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MDM.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\TASKMON.EXE
C:\MY DOWNLOADS\UTILITIES\BIG FIX\BIGFIX.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\ATICWD32.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\CYBERTRIO\SHOWMODE.EXE
C:\WARNER\WARNER.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\RNATHCHK.EXE
C:\MY DOWNLOADS\HIJACK DETECTER\10-07-2003\HIJACKTHIS.EXE

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://av.yahoo.com/bin/search?p=%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = HTTP://MICROSOFT.COM
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=proxy.prodigy.net:8080;http=proxy.prodigy.net:8080;http=proxy.prodigy.net:8080;http=proxy.prodigy.net:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = www.prodigy.net;enroll.prodigy.net;enroll-isp.prodigy.net
R3 - Default URLSearchHook is missing
F1 - win.ini: run=C:\windows\options\systools\cyxid98.exe hpfsched
O2 - BHO: (no name) - {576EB0AD-6980-11D5-A9CD-0001032FEE17} - C:\PROGRAM FILES\YAHOO!\COMMON\YCHECKH.DLL
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: Yahoo! Companion BHO - {13F537F0-AF09-11d6-9029-0002B31F9E59} - C:\PROGRAM FILES\YAHOO!\COMPANION\YCOMP5_0_2_4.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\YCOMP5_0_2_4.DLL
O3 - Toolbar: (no name) - {57E69D5A-6539-4d7d-9637-775DE8A385B4} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [AtiCwd32] Aticwd32.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [FontFix] c:\windows\options\systools\fntfix.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [CyberTrioModeInfo] C:\CyberTrio\ShowMode.exe
O4 - HKLM\..\Run: [SystemWizard Sniffer] C:\Program Files\Common Files\SystemSoft\sniffer.exe
O4 - HKLM\..\Run: [Warner] C:\Warner\Warner.exe
O4 - HKLM\..\Run: [OEMCleanup] C:\WINDOWS\OPTIONS\OEMRESET.EXE
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [CriticalUpdate] c:\windows\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\RunServices: [HOTKEY] C:\PROGRA~1\NAV\hotkey.exe /AUTO /BAR
O4 - HKLM\..\RunServices: [Machine Debug Manager] C:\WINDOWS\SYSTEM\MDM.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakLogon
O4 - Startup: BigFix.lnk = C:\My Downloads\Utilities\Big Fix\BigFix.exe
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Yahoo! Login (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Login (HKLM)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .mov: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/essentials/ymmapi_0410.dll
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://www.wildtangent.com/install/wdriver/sportsgames/ssxtricky/ea/wtinst.cab
O16 - DPF: {AB9820A0-02A9-11D5-A72F-004F4E002BD6} (JFC Classes) - http://216.27.30.197/java2/cabs/swing.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/bcd48c18cb7498/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37873.8298611111
----------------------------------------------------------------------------
2--I have downloaded the DLL library from Microsoft also and then did a find for the MFC42.DLL as you suggested. Then I checked the version on each one. I have attached a print screen of the results - including the version number: see ShoffATT1

I still cannot access my latest backup registry
******HOW do I get rid of some of the older registries that are
not any good? Only ONE of the five is a good registry -
and that is number 3.
I still cannot access my CD Rom ! ! ! This is CRITICAL ! ! !
Excel and Powerpoint still want to be "installed"
and
I still cannot use FrontPage Express because of the missing MFC42.dll
HELP PLEASE ! ! !

Thanks
Shoff
 

Attachments

Joined
Dec 9, 2000
Messages
45,855
Sorry I missed your new post.

If you downloaded the library update it looks like it did not install. ALL your mfc42.dll versions are old ones and the highest version is not even in the system folder.

How did you "install" the update? You should right click on the download url and save it to a convenient folder. Then close all open programs and run the setup. You may need to reboot afterwards for it to complete

After that you should have version Mfc42.dll 6.00.8267 in your System folder.

I don't think this is going to address the CD-ROM problem though, and this may be best addressed as a separate post in the Hardware forum

Is the CD-ROM listed in the Device Manager? Does it or any of the IDE controllers under Hard Disk Controllers have red x's or yellow exclamation points beside them? If so remove the device, or the Bus Master controller (if a primary or secondary IDE is flagged) and reboot.

Also, is "sniffer.exe" your install?
 

shoff

Thread Starter
Joined
Nov 13, 1999
Messages
153
I DO have sniffer.exe on my system (see Att3) but I don't know what it does. I didn't "knowingly" use it, but if it's automatic, then maybe I did.
I attached a print screen of the library I downloaded (See att2)

What I believe WILL help me be able to access my CD rom is becing able to access the backup registry I "restored" for 10/4
THIS IS CRITICAL !!! because time is running out!!!!
Isn't it? I need to be able to access that!
Last time I "lost my CD rom access" it was because of a Microsoft update and a problem with the registry,

I do NOT believe it is a hardware problem
If I can access my CD rom and reinstall my software, It will problably correct the situation.
So you see is why I want to find my registry

See the post:
------------------------------------------------------------------------------
BEGINNING OF POST
------------------------------------------------------------------------------
This is the thing that screwed it up .... It did the same thing to my pc ..

Intel Corporation - Storage - version 12/10/2001 - was successfully installed. 9:52:24 PM Thursday


Do this ... restart your PC in DOS mode

Click on START > SHUTDOWN > Put a chekmark on RESTART IN MS DOS MODE.
When your at the C:\ or C:\Windows prompt just type SCANREG /RESTORE and press enter

NOTE: DO NOT FORGET THE SPACE BETWEEN "SCANREG" and "/RESTORE"

You will see a menu with dates .... select yesterdays date and press enter.

Your PC will return to normal. =O)

If it doesnt .... then ..... I am ..... ummm .... a dookey head .... hee hee

Goood Luck




----- Original Message -----
From: The Hoffs, Sharon and Bryan
To: [email protected]
Sent: Sunday, February 17, 2002 7:42 PM
Subject: From TechGuys Support Forum


HELPPPPPPP PLEEEAAASSEEEE!
All of a sudden my CD Rom "cannot be found". I have gone into the
control panel/system/device manager and found 3 yellow exclamation
points:
Under "Computer"
CD-ROM controllers has a - (minus-sign) then:
(!) mitsumi CD-ROM Controller with Double Speed Drive
Hard disk controllers has a - (minus-sign) then
Ali M5229 PCI Bus Master IDE Controller
(!) Primary Ultra ATA controller
(!) Secondary Ultra ATA controller
_______________
I believe this is where my problem is but I have absolutely no clue as
to how to fix it.
Can you help?
-------------------------
I have a Packard Bell AMD K6 2
With a Windows 98 Operating system
-----------------------
Having reviewed some of the postings on bulletin boards,
I visited MS update and found my installation history.
It shows me the files I downloaded on 2/14/02:
-------------------
Security Update, February 11, 2002 (Internet Explorer 6) - version
6,0,2713,1100 - was successfully installed.
9:52:12 PM Thursday, February 14, 2002 : 5232
Intel Corporation - Storage - version 12/10/2001 - was
successfully installed.
9:52:24 PM Thursday, February 14, 2002 : 76035
MSN Messenger 4.6 - version 4,6,0,71 - was successfully
installed.
9:52:51 PM Thursday, February 14, 2002 : 5119
-------------------
How do I undo this?
There are no "uninstall" buttons on my installation history and when I
go to Product Updates and find these "already installed" There is no
"uninstall" button there either.
HELPPPPPPPPP!!!!!!!
-----------------------------------------------------------------------------
END OF POST
-----------------------------------------------------------------------------
 

Attachments

Joined
Dec 9, 2000
Messages
45,855
First let's run msconfig and temporarily UNcheck Scanregistry under the Startup tab. This will prevent Windows from archiving new registries and bumping out old ones.

If you didn't install Sniffer, then use HijackThis to delete the registry entry for it. (You may have to do this again if we do a scanreg /restore) and then delete the actual file.

Now in attachment 2 what you appear to be showing me is the setup file. If that is what you downloaded, you need to double click that to run it. If you are in doubt just do the download again to a convenient folder.

http://www.microsoft.com/ntworkstation/downloads/Recommended/ServicePacks/MFCLibrary.asp

Now let's see what registry archives you still have.

Do a Find Files for *rb and you should encounter 5 or more rbnnn.cab files in the c:\windows\sysbckup folder. The nnn will be a number. One of those may be named "bad". That is likely to be the one that current when you did the restore.

Let me know what you find and whether the dates precede or are the morning of the change.

From the looks of what you are reporting, this is going to be the CD-ROM problem:

Ali M5229 PCI Bus Master IDE Controller
(!) Primary Ultra ATA controller
(!) Secondary Ultra ATA controller

You may need to download and reinstall the controller drivers for your Ali chipset.
 

shoff

Thread Starter
Joined
Nov 13, 1999
Messages
153
============================
I just ran HiJack this again, but I do NOT know how to edit the registry so I am sending the log to you below
Then perhaps you can walk me through it???
 

Attachments

Joined
Dec 9, 2000
Messages
45,855
I'm sorry, I gave you the wrong search string, it should be

rb*

In any case they are in the c:\windows\sysbckup folder

Do you know your motherboard model?
 

shoff

Thread Starter
Joined
Nov 13, 1999
Messages
153
I found an MFC42.dll file which DOES work for opening my Front page express
I found it HERE:
http://www.geosoft.com/pinfo/free/faq.html
Under the link on item #2

The Version Number is NOT 6880, however my Front page DOES open using it
Version is: 6.00.8665.0
(I still can't open Excel or Powerpoint)
I need to reboot my system now, will be back online in about 10-15 minutes, and looking for my next instructions
Hope you don't mind working with me
I really appreciate your help!!!
Shoff
 

shoff

Thread Starter
Joined
Nov 13, 1999
Messages
153
New rb* find search see att6

I don't know how to find that out about the Motherboard
 

Attachments

Joined
Dec 9, 2000
Messages
45,855
I think that's what I have in my Win98 system as well. But if you didn't properly run the libraries setup you may have other file version issues as well.

My next instructions would be to avoid restoring a back up registry for now and see if we can find your Ali IDE drivers.

We may have to get them from the Motherboard vendor. Do you know the model? I can't seem to find them on the Ali site itself.

You have several registries dated on the 6th, and one months before that. The problem with trying to restore one of those is that you are going to restore registry entries for files that may have been deleted.

I personally don't think either ad-aware or spybot caused this problem. The issue with the CD-ROM is IDE driver related.

From the version number of your Ali IDE Controllers you should be using the same IDE drivers as for the Gigabyte motherboard on this link

http://www.fujitsu-siemens.co.uk/rl...oards/Motherboards/GigaByte/GA5AX/GA-5AX.html

Under the FILES header there is a download for ALI IDE drivers.

This is a zip file. When unzipped to its own folder you should see a "setup" file that can be run to install the drivers.
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Staff online

Top