1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Windows ME Error. Help Needed ASAP

Discussion in 'Earlier Versions of Windows' started by W-1.0, Sep 15, 2004.

Thread Status:
Not open for further replies.
Advertisement
  1. W-1.0

    W-1.0 Thread Starter

    Joined:
    Jan 16, 2004
    Messages:
    107
    Hello Guys! :)

    Been having problems after I have installed Broadband yesterday on my Dad's ME computer. I did a few Windows updates and now I'm having big problems with Windows Explorer.

    Basically, Windows Explorer won't open and I keep getting error messages - I've attached two of the more frequent ones. WebRebates keeps coming up which I know is Spyware or Adware, but Spybot/ AdAware won't pick it up. I just need to get it working properly. Please look at the attachments. (y)

    Internet Explorer works fine, but the only way I can access Drive C is by typing C:\ in the address bar of Internet Explorer. :confused:

    Is this a common problem with ME, or after updates? What can I do to try and get Windows Explorer working again without any error messages?

    Any help would be much appreciated. (y)


    Will :)
     

    Attached Files:

  2. W-1.0

    W-1.0 Thread Starter

    Joined:
    Jan 16, 2004
    Messages:
    107
    Hello Guys again. (y)

    I am really desperate for some help as my Dad is going mad at the minute as Broadband won't work. Apart from Windows Explorer displaying error messages, Internet Explorer also displays error messages now.

    What do you think it is? Can I re-install Internet Explorer/Windows Explorer?

    Thanks for any help in advance. :)


    Will :)
     
  3. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    First of all the error message indicates you have "malware" installed on the computer.



    Have you tried doing a System Restore? It will revert any recent installs or uninstalls. Start > Run: msconfig > launch system restore.


    But you will still need to clean the system of malware.

    Please download, copy over if necessary, and run HijackThis. Then post the results of the HijackThis Scanlog here:

    http://www.net-integration.net/tools/hijackthis.html

    Be sure you save HijackThis in My Documents, not in a temporary folder.
     
  4. W-1.0

    W-1.0 Thread Starter

    Joined:
    Jan 16, 2004
    Messages:
    107
    Hello Rollin' Rog.

    Thank you for your reply! Yes, I've tried doing a System Restore to a few days ago, but it won't work and there aren't any earlier system restore points.

    I'll post up a HiJackThis log ans see whether any of you can work out what the hell is going on! I certainly can't!

    Cheers

    Will :)
     
  5. W-1.0

    W-1.0 Thread Starter

    Joined:
    Jan 16, 2004
    Messages:
    107
    Hello again!

    I've attached a copy of my HiJackThis log so please can you have a look and see whether there is anything in there that shouldn't be there!

    Cheers

    Will :)

    Logfile of HijackThis v1.98.2
    Scan saved at 19:14:16, on 16/09/2004
    Platform: Windows ME (Win9x 4.90.3000)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\PROGRAM FILES\WINDUPDATES\WINUPDT.EXE
    C:\PROGRAM FILES\WINDUPDATES\WINKA.EXE
    C:\WINDOWS\SYSTEM\RNAAPP.EXE
    C:\WINDOWS\SYSTEM\TAPISRV.EXE
    C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
    C:\WINDOWS\SYSTEM\PSTORES.EXE
    C:\WINDOWS\SYSTEM\STIMON.EXE
    G:\HIJACKTHIS.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://best-search.cc/search.php?v=6&aff=5877509
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://best-search.cc/index.php?v=6&aff=5877509
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\SYSTEM\MSBE.DLL
    O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\SYSTEM\NVMS.DLL
    O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\SYSTEM\MSCB.DLL
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
    O2 - BHO: Setup.Setup1 - {2E65A557-173C-4DE9-860B-28FC5CACA542} - C:\WINDOWS\ALL USERS\APPLICATION DATA\SETUP\SETUP.DLL
    O2 - BHO: twaintecObj Class - {000020DD-C72E-4113-AF77-DD56626C6C42} - C:\WINDOWS\TWAINTEC.DLL
    O2 - BHO: Popup Blocker Pro - {A44B961C-8C36-470f-8555-EDA0EFC1E710} - C:\PROGRAM FILES\SAFEGUARD POP-UP BLOCKER PRO FREE EDITION\POPUPBLOCKER.DLL
    O2 - BHO: Core Library - {A23AB93D-6CFF-442c-BB8A-41F6145F47E7} - C:\WINDOWS\SYSTEM\PDF0448.DLL
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O4 - HKLM\..\Run: [WindUpdates] C:\PROGRAM FILES\WINDUPDATES\WINUPDT.EXE
    O8 - Extra context menu item: Web Rebates - file://C:\PROGRAM FILES\WEB_REBATES\Sy1150\Tp1150\scri1150a.htm
    O12 - Plugin for .au: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin2.dll
    O12 - Plugin for .mpeg: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin3.dll
    O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_f...59a785454063:4be19311a3dba47d5280e4704df77179
    O16 - DPF: {88C51E90-8E9C-4C96-8A45-574D88B63FAF} (Matrix Class) - http://acceso.masminutos.com/laaplicacion.cab
    O18 - Filter: text/html - {4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB} - C:\WINDOWS\SYSTEM\XPLUGIN.DLL
     

    Attached Files:

  6. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    [​IMG] Have these instructions printed or in a convenient Notepad (or Wordpad) file so you can view them in Safe Mode. Have "show hidden (or all) files" checked in Folder Options > View in case you have to search for any hidden files to delete. Also ensure you do NOT have "hide file extensions..." enabled in Folder Options > View

    Download and unzip to a convenient location the CoolWebShredder, CWShredder.exe available here: http://www.computercops.biz/downloads-cat-14.html

    Then:

    1 >> Restart in Safe Mode: http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406

    2 >> In Safe Mode run the CoolWebShredder and have it "fix" detected problems. Then run HijackThis and check and "fix" the following entries:

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://best-search.cc/search.php?v=6&aff=5877509
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://best-search.cc/index.php?v=6&aff=5877509

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\SYSTEM\MSBE.DLL
    O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\SYSTEM\NVMS.DLL

    O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\SYSTEM\MSCB.DLL

    O2 - BHO: Setup.Setup1 - {2E65A557-173C-4DE9-860B-28FC5CACA542} - C:\WINDOWS\ALL USERS\APPLICATION DATA\SETUP\SETUP.DLL

    ^^ I don't think the "setup" folder is a valid one. See what else is in there. You can rename the folder "setupbak" if in doubt and delete it later if nothing breaks.

    O2 - BHO: twaintecObj Class - {000020DD-C72E-4113-AF77-DD56626C6C42} - C:\WINDOWS\TWAINTEC.DLL

    O2 - BHO: Core Library - {A23AB93D-6CFF-442c-BB8A-41F6145F47E7} - C:\WINDOWS\SYSTEM\PDF0448.DLL

    ^^ note, all of the dlls targeted here should be deleted by HijackThis, but you should really manually verify it as well

    O4 - HKLM\..\Run: [WindUpdates] C:\PROGRAM FILES\WINDUPDATES\WINUPDT.EXE
    O8 - Extra context menu item: Web Rebates - file://C:\PROGRAM FILES\WEB_REBATES\Sy1150\Tp1150\scri1150a.htm

    ^^ in Safe Mode delete both the windupdates and the Web_Rebates folders.

    Additional cleanup instructions: Go to the Control Panel > Internet Options applet. Clear the Temporary Internet Cache, History and Offline Content. Go to the Programs tab and select "reset web settings", including your home page if it has been altered. You can reset that later to what you desire.

    Go to Start > Run, enter %temp% and then click Edit > Select All. Right click on the selected files and folders and delete them


    On rebooting and reconnecting to the net, create and post another Scanlog. Let me know the details of any remaining errors or problems.
     
  7. W-1.0

    W-1.0 Thread Starter

    Joined:
    Jan 16, 2004
    Messages:
    107
    Hello Rollin' Rog! :)

    Thank you for your reply! When I started up the computer today, it opened Windows Explorer for the first time, but then closed again! Having the same problem!

    I will try what you have told me and let you know how I get on.

    Thanks for any replies! (y)


    Will :)
     
  8. mfinnell

    mfinnell

    Joined:
    Aug 24, 2004
    Messages:
    197
    Had same Problem in My ME follow all links in LDtate reply in Security Forum "Browser hijack HELP"took ,me 2 days but i been fighting it over a month
     
  9. W-1.0

    W-1.0 Thread Starter

    Joined:
    Jan 16, 2004
    Messages:
    107
    Hello Rollin Rog! :)

    I've done everything you have suggested and now Windows Explorer seems to be cured! Thanks for excellent advice and help. :) I was very impressed with your detailed instructions, including commands. Some people do not bother and errors take twice as long to fix if the instructions are miss-leading.

    I've posted up my HiJackThis log so you can have a look at it, but there are only a few things left in the list which look pretty harmless. ;)

    I've got a few errors with my own laptop at the minute. I've started a thread in the XP section, so please have a look if you have time!

    Thanks for all your help. It's been GREAT! :) :) :)


    Will (y)

    Logfile of HijackThis v1.98.2
    Scan saved at 17:45:25, on 17/09/2004
    Platform: Windows ME (Win9x 4.90.3000)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\SYSTEM\DDHELP.EXE
    C:\WINDOWS\SYSTEM\STIMON.EXE
    C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
    C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\WINWORD.EXE
    C:\WINDOWS\SYSTEM\SPOOL32.EXE
    C:\WINDOWS\TEMP\TD_0005.DIR\HIJACKTHIS.EXE

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tiscali.co.uk/broadband/
    O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\SYSTEM\MSBE.DLL
    O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\SYSTEM\NVMS.DLL
    O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\SYSTEM\MSCB.DLL
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
    O2 - BHO: Setup.Setup1 - {2E65A557-173C-4DE9-860B-28FC5CACA542} - C:\WINDOWS\ALL USERS\APPLICATION DATA\SETUP\SETUP.DLL
    O2 - BHO: Popup Blocker Pro - {A44B961C-8C36-470f-8555-EDA0EFC1E710} - C:\PROGRAM FILES\SAFEGUARD POP-UP BLOCKER PRO FREE EDITION\POPUPBLOCKER.DLL
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
    O12 - Plugin for .au: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin2.dll
    O12 - Plugin for .mpeg: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin3.dll
    O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_f...59a785454063:4be19311a3dba47d5280e4704df77179
    O16 - DPF: {88C51E90-8E9C-4C96-8A45-574D88B63FAF} (Matrix Class) - http://acceso.masminutos.com/laaplicacion.cab
     

    Attached Files:

  10. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\SYSTEM\MSBE.DLL
    O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\SYSTEM\NVMS.DLL
    O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\SYSTEM\MSCB.DLL

    O2 - BHO: Setup.Setup1 - {2E65A557-173C-4DE9-860B-28FC5CACA542} - C:\WINDOWS\ALL USERS\APPLICATION DATA\SETUP\SETUP.DLL


    These items are all of concern. Did you delete them in Safe Mode and have them return?

    Please do it again. And if by any chance you are starting in Safe Mode with Networking support -- don't. You want to be completely disconnected from the internet when carrying out these instructions.

    The bolded "setup" folder in Application Data should be deleted as well.

    I would also recommend you install and Update Ad-aware SE, including the VX2 plugin and be sure to run a full drive scan.

    Ad-Aware Home Page


    http://download.lavasoft.de.edgesuite.net/public/plvx2cleaner.exe
    The VX2 plugin will be available in the "add-ons" window once installed and is run from there.

    By the way in posting Scanlogs, it's best to copy/paste them to your post rather than upload them as attachments; it makes for easier reading and research.
     
  11. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/274372

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice