Unsolved
This post is more than 5 years old
4 Posts
0
7946
October 15th, 2004 14:00
Computer problems- variety of issues
I am hoping someone might be able to shed some light on the issues I'm facing. I have been using an on-line service (webct) that is required for my graduate classes. Since starting to use it the computer has been running pretty slow and crashing often. I decided to clean up the computer a little. I removed all unneccesary programs (kids games, husband's games, software we didn't use anymore) all through add/remove programs. I then cleaned up excess files from school, pics, other things we didn't need. I deleted all files from e-mail that weren't needed (sent, delete, extras), ran ad aware and quarantined all the critical objects they pointed to. I cleared the cache, history and cookies , deleted items from recycle bin. I then ran scandisc as defrag wouldn't work, after shutting down everything except explorer, I disabled the quick launch and ran defrag. At the beginning I had 9.2 GB free on harddrive. After all this was done I had 19.4. This is where major problems began. The computer would not shut down. Whenever I used the shutdown, I would get the following error: VWIM32(05)+00000BF4 Error :0E:0028:c02A3Dcc on blue screen. I would need to reboot to get back to windows. This happened several times. I unplugged the system and when I plugged it back in I got the following note about a missing file c:\\windows\temp\patch411.exe that said to reinstall it. Since it was in the temp folder I didn't think it was something important, but maybe some kind of virus or spyware. I ran Norton anti-virus, which crashed halfway through, and computer froze. It had notation that 2 infections were found and fixed, but I could not get the report to read as it was frozen. After rebooting I ran the program again and it came up with no infections. I checked my memory and my free space was down to 5.1GB in a mere half hour!! My hard drive light is on almost constantly and it is constantly running, or at least more than normal. I did use the disk clean up and deleted all tmp files and recycle bin again. I was back up to 8 GB of free memory. I then used msconfig and unclicked everything for start up and was able to finally shut the machine down.
I did receive another error after rebooting on blue screen 0E:01A7:BFF8E64B and received a KRNL386.exe error
Where I am now. I currently show 4.4 GB free memory (down from 19 : 2 days ago!!!) Computer is still slow, still freezes whenever I open the website for my class. hard drive running a lot I am also receiving a lot of pop ups now, but that could be due to my selective start up. I am running Windows ME on a Dell Dimension 4100. I have 2 harddrives a 40 GB and an 80 GB. I have not added or downloaded anything to add this much memory used.
Any help or assistance would be greatly appreciated.
Thanks,
Carla
No Events found!
Midnight Star
4.8K Posts
0
October 15th, 2004 15:00
If it's possible, could you also post the "HiJackThis" log here. It would be interesting to see just what might be causing the problem, and give us some experience 'looking' over them.
GOOGLE didn't have any information on "patch411.exe", and that makes it 'suspect'.
Mike.
Denny Denham
2 Intern
•
18.8K Posts
0
October 15th, 2004 15:00
If the only spyware detection program you used was Ad-aware, you should run at least Spybot, as it detects things that Ad-aware misses. The rapid decrease of free space on your hard drive points to malware. Download Spybot from here. Check online for updates to its database then run it and delete all the spyware it identifies.
If that does not rectify the problem download HijackThis from here. Run it and post the log it generates at http://forums.tomcoyote.org/ where the experts can analyze it and provide corrective measures.
The other option available to you is to back up all your perishable data (e-mail folders, address books in e-mail programs, My Documents folders, your Desktop, Favorites, Web browser bookmarks, and any other data that has been created by specific applications) then format your boot drive and reinstall ME. The backup should not be an overwhelming problem since it appears that you have already done a thorough job of cleaning the computer of unnecessary items.
sixstoneys
4 Posts
0
October 15th, 2004 16:00
Additionally, I went back to add/remove programs and all the programs I removed 2 days ago are showing up again?! Is this normal? I clicked on a couple of the kids games programs and received the following error: unable to locate/process internal binary resource. Please contact software vendor
This has me so confused. I do have spybot on the computer as well. I will run it.
I tried to add my new antivirus software and it kept giving me errors saying the disk was full.
I appreciate the responses. I really can't stand the idea of having to reinstall windows... I have a lot of stuff stored on here (school, kids pics, genealogy files....)
Thanks,
Carla
Midnight Star
4.8K Posts
0
October 15th, 2004 17:00
Carla,
Can you tell us what you removed using the "Add/Remove programs"? Since your computer 'crashed' while running Norton's, it's possible some of the 'fixed' files were compromised system files. Have you tried TrendMicro's "HouseCall" - it's a free online virus scan. It takes a little time to initially setup, but it may allow you to complete the scan.
To try and regain some space, clear out your temporary internet files, including all offline content. Also, have you tried using "cleanmgr.exe" to help you regain some space? I'm not sure how it works in "Windows ME", but in "WindowsXP it seems to pick up quite a few items.
Let's also run "CHKDSK" from a command line, without any options, just to see if we have any 'problems' on the harddrive, or with the access tables.
You can use "Windows Task Manager", under the "Networking" tab to check the 'traffic' for your internet connection. If your not doing anything online, and your system isn't 'connection sharing' with another computer, and your getting constant traffic, you've more than likely have a problem. Someone may be using your system as a spam 'relay', or to store really 'bad' stuff on your computer, and sending it across the net from there.
I know some of these require disk space, but maybe we can get some of them in.
You can also try:
Another possibility, if your not using a firewall is:
Finally, I need you to download and run "HiJackThis". We're going to use this program, in an attempt to see what's being run on your computer at startup, not to necessarily 'fix' them using it:
From that, we might be able to see just what the problem might be.
Once you get everything clear, we might need to do a 'repair' installation of your operating system to replace anything that might have gotten 'trashed' by the 'bad' stuff. This link might help you understand what would need to be done for you operating system.
Mike.
sixstoneys
4 Posts
0
October 15th, 2004 21:00
And I forgot I removed the following:
Jumpstart Kindergarten, Candyland, Tonka Construction and Raceway, Finding Nemo, Deer Hunter 2-4; 2 other hunting games, Nascar 2000, Driver, a few other games
QuickBooks Pro, DB Amp music converter; DrawPlus3.0; print shop III; Hobbyware Cross Stitch Maker, PAttern Viewer; some other programs that I have software for that can always be installed later.
That's all from memory, I can generate an exact list if need be.
Carla
sixstoneys
4 Posts
0
October 15th, 2004 21:00
This is my log:
Logfile of HijackThis v1.98.2
Scan saved at 6:15:59 PM, on 10/15/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\JAVA\PACKAGES\SYSXML.EXE
C:\PROGRAM FILES\HIJACK THIS\HIJACKTHIS.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.dell.com/search/index.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://cgi1.ebay.com/aw-cgi/ebayISAPI.dll?MyEbayItemsBiddingOn&userid=stoney5&pass=ytnqDkD4a0Chuk7k/Khve12&first=N&sellerSort=3&bidderSort=3&watchSort=3&dayssince=2&p1=0&p2=0&p3=0&p4=0&p5=0
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = sas.r6.attbi.com:8000
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O1 - Hosts: .zestyfind.com
O1 - Hosts: .zestyfind.com
O1 - Hosts: ww.zestyfind.com
O1 - Hosts: ww.zestyfind.com
O1 - Hosts: 12
O1 - Hosts: do.com
O1 - Hosts: mundo.com
O1 - Hosts: rtumundo.com
O1 - Hosts: 1.vx2.cc
O1 - Hosts: 1
O1 - Hosts: 127
O1 - Hosts: 127.0.0.21.com
O1 - Hosts: 127.0.0.
O1 - Hosts: 127.0..com
O1 - Hosts: 127.0.
O1 - Hosts: 127.0.
O1 - Hosts: 127.0.
O1 - Hosts: om
O1 - Hosts: o.com
O1 - Hosts: undo.com
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL (file missing)
O2 - BHO: CATLEvents Object - {60112085-E1CE-4e0e-823A-EBB1AD98804C} - C:\WINDOWS\TEMP\LLDBK.DAT
O2 - BHO: CATLEvents Object - {6A06CDAD-9D2D-42A0-9C91-C0CF7CB9971B} - C:\WINDOWS\TEMP\LMXSYS.DAT
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [FFIX32] C:\WINDOWS\SYSTEM\Dractx.exe
O4 - HKLM\..\RunOnce: [*SYSXML] C:\WINDOWS\JAVA\PACKAGES\SYSXML.EXE rerun
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
O4 - HKCU\..\Run: [FFIX32] C:\WINDOWS\SYSTEM\Dractx.exe
O4 - HKCU\..\RunOnce: [*MS Setup] C:\WINDOWS\SYSTEM\BKINST.EXE ren time:1097681089
O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE10\EXCEL.EXE/3000
O9 - Extra button: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM (file missing)
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM (file missing)
O9 - Extra button: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM (file missing)
O9 - Extra 'Tools' menuitem: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM (file missing)
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe (file missing)
O9 - Extra button: Dell Home - {08DCFC6C-B6E4-480C-95A4-FC64F37B787E} - http://www.dellnet.com (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.dellnet.com
O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} (PWMediaSendControl Class) - http://216.249.24.143/code/PWActiveXImgCtl.CAB
O16 - DPF: {1954A4B1-9627-4CF2-A041-58AA2045CB35} (Brix6ie Control) - http://a19.g.akamai.net/7/19/7125/1410/ftp.coupons.com/v7/brix6ie.cab
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://support.dell.com/us/en/systemprofiler/SysProfLCD.CAB
O16 - DPF: {75565ED2-1560-4F15-B841-20358DE6A0D1} (ImageControl Class) - http://content.ancestry.com/asfiles/files/install/MFImgVwr.cab
O16 - DPF: {C6B086D2-146B-47A4-A218-B82DCAF2D872} (cpbrxpie Control) - http://a19.g.akamai.net/7/19/7125/4003/ftp.coupons.com/r3120/cpbrxpie.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/1,5,0,4287/mcfscan.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab
O16 - DPF: {861DB4B6-3838-11D2-8E50-002018200E57} (MrSIDI Control) - http://images.myfamily.net/isfiles/downloads/MrSIDI.cab
O16 - DPF: {B160422D-0A48-11D4-BD9B-00A0C9B0AB7B} (Download Class) - http://expressit.broderbund.com/plugin/Download.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_41.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-9.cab
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/1437/ftp.coupons.com/v3123/cpbrkpie.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\PROGRAM FILES\HP\HPCORETECH\COMP\HPUIPROT.DLL
I posted it at coyote forum as well. I ran House call and it came up with following infections:
BK.DR FLUX.C; TROJ Agent.EA; TROJ AGENT.EA; TROJ SMALL.BM
Thanks for your help!
Carla
Midnight Star
4.8K Posts
0
October 15th, 2004 22:00
Check you 'hosts' file for any 'problems', these entries look rather strange:
O1 - Hosts: .zestyfind.com
O1 - Hosts: .zestyfind.com
O1 - Hosts: ww.zestyfind.com
O1 - Hosts: ww.zestyfind.com
O1 - Hosts: 12
O1 - Hosts: do.com
O1 - Hosts: mundo.com
O1 - Hosts: rtumundo.com
O1 - Hosts: 1.vx2.cc
O1 - Hosts: 1
O1 - Hosts: 127
O1 - Hosts: 127.0.0.21.com
O1 - Hosts: 127.0.0.
O1 - Hosts: 127.0..com
O1 - Hosts: 127.0.
O1 - Hosts: 127.0.
O1 - Hosts: 127.0.
O1 - Hosts: om
O1 - Hosts: o.com
O1 - Hosts: undo.com
If you, someone you know, or any 'spyware' prevention program put them there, i'd remove all entries except the first 127.0.0.1 entry.
For these entries, do a GOOGLE on "bkinst.exe". I found two instances at "Spyware Warrior" and "Tech Support Forum" where these entries were removed. I'd check these first to see if there are any special 'fixing' circumstances.
O4 - HKCU\..\RunOnce: [*MS Setup] C:\WINDOWS\SYSTEM\BKINST.EXE ren time:1097681089
O2 - BHO: CATLEvents Object - {60112085-E1CE-4e0e-823A-EBB1AD98804C} - C:\WINDOWS\TEMP\LLDBK.DAT
O2 - BHO: CATLEvents Object - {6A06CDAD-9D2D-42A0-9C91-C0CF7CB9971B} - C:\WINDOWS\TEMP\LMXSYS.DAT
Also, are these entries still there after running HouseCall?
Mike.