Win 95 registry probs 1

[Ngolem]

I am getting a more than usual number of registry problems in the last few weeks while running Internet Explorer.

I can find no problems running Ad-aware, SpyBot and the following is the HiJackthis log


Logfile of HijackThis v1.97.7
Scan saved at 5:31:44 PM, on 7/22/04
Platform: Windows 95 B (Win9x 4.00.1111)
MSIE: Internet Explorer v5.51 SP2 (5.51.4807.2300)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\LOADWC.EXE
C:\PROGRAM FILES\ANALOGX\COOKIEWALL\COOKIE.EXE
C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER\DPPS2.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
D:\ZIPS_INSTALLS\HIJACKTHIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.yahoo.ca/

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [BrowserWebCheck] loadwc.exe
O4 - HKLM\..\Run: [CookieWall] C:\PROGRAM FILES\ANALOGX\COOKIEWALL\COOKIE.EXE
O4 - HKLM\..\Run: [Pop-Up Stopper] "C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER\DPPS2.EXE"
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKCU\..\Run: [svchost] C:\WINDOWS\SVCHOST.EXE
O9 - Extra button: ICQ Pro (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -

http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Please advise if you see anything wrong here....or how I can troubleshoot/fix these registry problems.

this group has helped me a lot...I appreciate it very much


Jim Broadbent

The quality of the answer is directly proportional to the quality of the problem statement!

 

[Ngolem]

Hmmm...no registry probs and things are like night/day as far as my net graphics HOWEVER...something launched an empty Task dialog box today when I booted the computer.

Any ideas how to track this down?

Jim Broadbent

The quality of the answer is directly proportional to the quality of the problem statement!

 

[TekTippy4U]

Look in Scheduled Tasks folder
Have TaskMonitor running? - Go into Advanced and "Stop using Task Scheduler"
D/l the MSCONFIG I posted earlier and
Start > Run MSCONFIG
Look at Startup Tab - and the others for funky programs

Start > Run REGEDIT
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Look at ALL the RUN Keys
and in HKEY_CURRENT_USER as well.

HJT usually lists these as your earlier log shows
For ex;
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [BrowserWebCheck] loadwc.exe
O4 - HKLM\..\Run: [CookieWall] C:\PROGRAM FILES\ANALOGX\COOKIEWALL\COOKIE.EXE
O4 - HKLM\..\Run: [Pop-Up Stopper] "C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER\DPPS2.EXE"
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKCU\..\Run: [svchost] C:\WINDOWS\SVCHOST.EXE;


Also look at C:\WINDOWS\SchedLog.Txt

TT4U

Notification:
These are just my thoughts....and should be carefully measured against other opinions.
Backup All Important Data/Docs

 

[TekTippy4U]

Also Jim;
see my references to the SYSTEM.INI and WIN.INI entries using MSCONFIG in this thread615-885606
this will show you what to look out for, as far as malware that shouldn't be there.
Also in MSCONFIG
Check your Config.sys and Autoexec.bat for errant entries (I know you're pretty good with DOS).
Must use High security when using IE
SEE THIS Please and apply security settings to IE...also use dropdown box for much more.
Get a free firewall too if you must continue using IE

TT4U

Notification:
These are just my thoughts....and should be carefully measured against other opinions.
Backup All Important Data/Docs

 

[Ngolem]

I was wrong...it was not a task scheduler that was launched

It was Taskman.exe 28Kb 08/24/96

I have been reading that this could be infected. But I cannot seem to find out the size this program officially should be.

I did see a reference where the properties window of taskman was opened and the version was much more recent than my version and showed the size as only 15Kb

Is this an infected file?

Jim Broadbent

The quality of the answer is directly proportional to the quality of the problem statement!

 

[TekTippy4U]

hi jim;
Mine is 98 ver in C:\WINDOWS
48.0kb (49,152 bytes)
5/11/98
File ver 4.00.47
Windows Task Switcher
Copyright © Microsoft Corp. 1991-1995

If you're worried -- can you just rename/delete it
and Replace from Install disks? or .cab files?
Have you been able to use Extract ?
and are your .cabs on HDD?...or on 95CDROM?...or DMF disks?

TT4U

Notification:
These are just my thoughts....and should be carefully measured against other opinions.
Backup All Important Data/Docs

 

[Ngolem]

I looked in the cab files using winZip [hope that is ok ] and the file size is the same.

Can you use Winzip to extract info from Cab files ... it is called a WinZip typ file ... or is the DOS "Extract" better.

Jim Broadbent

The quality of the answer is directly proportional to the quality of the problem statement!

 

[TekTippy4U]

WinZip is ok i guess;
Just that Extract from DOS or SFC in 98 allows you to overwrite the file - DOS cause it's not in use (no 32bit modules loaded) and SFC cause it just works that way.
you may have to delete the file first...or rename it first.

If the file size is the same, there's a good chance though not failsafe that it's correct and not corrupt. Can't hurt to replace with orig. Possibly an entry is triggering TaskManager. Look into TaskMonitor (Taskmon.exe 32bit) too if it exists in 95b (don't think so).

Look at your MSCONFIG values (shows Startup items in Startup tab, but no protocol.ini shown) in all files relating to TaskMan or aTaskMon

Start > Run SYSEDIT too for errant protocol.ini entries (does NOT show Startup items in Startup tab)

TT4U

Notification:
These are just my thoughts....and should be carefully measured against other opinions.
Backup All Important Data/Docs

 

[Ngolem]

******
Look at your MSCONFIG values (shows Startup items in Startup tab, but no protocol.ini shown) in all files relating to TaskMan or aTaskMon
******

MSCONFIG?? Where are these values located?? I don't have a file by that name on my system.

Also I frequently encounter this Browser error. There is a message to report the error to MSN which I have ignored until recently. There is a technical section that would be sent to MSN if I allowed it.

It seems it is a "signature error"

Error details
Internet Explorer has encountered an internal error.

Error signature
AppName: iExplore.exe AppVer 5.51.4807.2300
ModName:Flash.ocx ModVer: 7.0.14.0
Offset: 0002bdc5

On another occassion I got the same error but instead of ModName: Flash.ocx it was ModName: Mshtml.dll

There is a technical dump showing info on each dll involved. The signature on most is consistantly feef04bd but on some dll's it is 00000000.

I should point out that My IE is not the original since that is quite old. When I reinstalled Win95 a while back I sourced out a copy of 5.51 from another party on the net (the name escapes me right now so that I would have the highest version compatible with Win95.




Jim Broadbent

The quality of the answer is directly proportional to the quality of the problem statement!

 

[TekTippy4U]

Go to C:\Windows\Downloaded Program Files and find the Shockwave .cab and delete it.
C:\WINDOWS\SYSTEM\MACROMED\FLASH
delete everything except .ocx - if still problems delete the .ocx

You're having fatal IE errors....rip out the beast, and Use FireFox. If you kept IE down to 4.0 (4.72) you'd be OK for the most part.

Look up in my earlier posts and you'll find a link to D/l MSCONFIG for 95....do it....you'll not regret it

TT4U

Notification:
These are just my thoughts....and should be carefully measured against other opinions.
Backup All Important Data/Docs

 

[Ngolem]

Well yuo certainly have improved the speed of my machine.

I removed Shockwave and those freaken slow movies don't run and they just display the final frame as a banner.

However, it constantly tries to download. Is there an automatic way to refuse this...it can be tiring.

I checked out for MSCONFIG.exe and could only find one place for it that was supposed to be for Win95. If I install this are the settings obvious? Also Foxfire...can it be installed over IE then remove IE??

Jim Broadbent

The quality of the answer is directly proportional to the quality of the problem statement!

 

[TekTippy4U]

Q Is there an automatic way to refuse this...it can be tiring.
A Yes -- Internet Options > Advanced > Untick the two "Enable installastion of desktop items" or somesuch - also untick "Enable third party browser extensions". If I recall correctly they're right next to each other.
See this for Internet Zone settings (Custom)

http://www.mvps.org/winhelp2002/unwanted.htm

Msconfig;

http://www2.whidbey.com/djdenham/Msconfig.htm

just put it in the \System folder, and double click it to start - create a shortcut to it.....or Start > Run MSCONFIG

yes - msconfig is pretty self explanatory;
Config.sys, Autoexec.bat, System.ini, Win.ini and Startup tab - Like I said - it's like Sysedit only with "check boxes" to enable/disable - But It's also got the startup tab , and also has an Advanced feature.
see this "Using the System Configuration Utility"

http://www.microsoft.com/resources/documentation/windows/98/all/reskit/en-us/part5/wrkc27.mspx

jump halfway down the page.

Firefox and Mozilla are kinda modular and self-contained, and not OS dependent like IE - and they use all their own settings...set it as your Default browser after installing. If you want to use it in conjunction with IE, just check-out/change Internet Options > Programs tab for the default Apps that open (such as Mail). there's also that check box in IE Programs tab for "IE should check if it's the default" crud. Mozilla/Firefox can set it's File types and Protocols to open..there's quite a bunch of settings in there to play with and the Moz interface (GUI) is slightly diff than Firefox (as far as settings).

TT4U

Notification:
These are just my thoughts....and should be carefully measured against other opinions.
Backup All Important Data/Docs