[dawn]

OK...just after I told you I had "fixed" my issue in post 7. My computer locked up. I can't figure it out so I am not on a different computer. Here is the error on the BSOD

An exception OE has occurred at 0028:C2469B88 in VxD e100bnt(01) +
00001CA8. This was called from 0028:C00618A4 in VXD NDIS (01) +
00008660. It may be possible to continue normally.

*press and key.........you know the rest

If I press any key I can get my desktop but no Network or internet. So I saved a HJT file to a disk in case you would want that for some reason.

Should I do your fix from the last message?

I did find the batch files to do a 95 driver disk with "no extras" that I was going to try to use to update my driver. Can I go ahead and do this?

Thanks

[Advertisements]

addition to post 13.

I just remembered that I booted into safe mode and deleted the device 1st. Then I rebooted, it found the device and reinstalled it. It was AFTER this that I had to change the bindings and add the ICP/IP. Sorry to have left out details.

[dawn]

addition to post 13.

I just remembered that I booted into safe mode and deleted the device 1st. Then I rebooted, it found the device and reinstalled it. It was AFTER this that I had to change the bindings and add the ICP/IP. Sorry to have left out details.

[gerryf]

definitely update your drivers...might solve your whole issue.

You mentioned earlier that you had an Express Pro/100+ PCI Adapter
--this is the device driver for it
VxD e100bnt(01)
wol558.vxd is also a driver file, but it is unclear what it does to me...

Either way, you can also download more recent ones here
http://downloadfinde...E&ProductID=401


NDIS.vxd allows your NIC to handle multiple protocols....for example, tcpip (the language of the internet) netbios, ipx/spx (novell)....

[gerryf]

btw...this is really a windows 95 machine.....wow, I thought only my brother in law was still using it. Course, we had to pry the windows 3.11 computer from his hands and none of us are up to taking away his treasured pentium 1 90 mhz machine.....

[dawn]

Yes...this is a 95 machine....I would love to use it as a boat anchor. I personally use xpsp2, MUCH nicer. I am working really hard on the bossman about upgrading... the bigger issue is that we run manufacturing software that will need to be upgraded as well. It is his computer that is having the malware issue....I was hoping that would be enough to get me new ones.....

I will do as you suggested using the driver. The site you posted is where I got the driver that is causing me all these issues. But in the download, there is a "Make 95 disk" that is stripped down. That is the one that I am going to try now. I will let you know.

again thanks....

[gerryf]

you must work for my brother in law.....

[dawn]

OK....it is now working. No blue screen. No error. BUT I have one last queston for you. Why can't I install Ad-aware SE or Spybot S&D or CWShredder on this system. I get dll errors one after another? Are they not compatable with 95?

Thanks for your help with the last...dawn

[gerryf]

possibly because of windows 95....win95 lacks as a default the visual basic runtime files needed for some programs...cws shredder did need them for sure, don't know about the others.

http://www.microsoft...&displaylang=en

you can download those and see if it works, but win95 does lack some basic things taken for granted by programmers

[dawn]

No go with the adaware and others, the window 95 thing is probably why nobody wants to touch my spyware issue on the other forum

Thank you for your assistance in resolving my error issue, I really appreciate it! Again, what a great service.

dawn

[gerryf]

I took a quick look at the hijackthis log you posted over there...could you post another here....you had a program install in processs (maybe on that one).

[dawn]

As requested: Thanks!


Logfile of HijackThis v1.99.1
Scan saved at 3:26:05 PM, on 4/20/05
Platform: Windows 95 C (Win9x 4.00.1212)
MSIE: Internet Explorer v5.51 SP2 (5.51.4807.2300)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\DRMON\SMARTAGT\SMARTAGT.EXE
C:\PROGRAM FILES\PWRCHUTE\UPS.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\MGACTRL.EXE
C:\PROGRAM FILES\MATROX MGA POWERDESK\COLOR\HGCCTL95.EXE
C:\PROGRAM FILES\PWRCHUTE\ICONCLNT.EXE
C:\WINDOWS\SYSTEM\HPOOPM07.EXE
C:\WINDOWS\SYSTEM\LOADWC.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\HP OFFICEJET K SERIES\BIN\HPODEV07.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\HP OFFICEJET K SERIES\BIN\HPOEVM07.EXE
C:\WINDOWS\SYSTEM\HPOINW07.EXE
C:\PROGRAM FILES\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.foxnews.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.foxnews.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [MGA Control Center] Mgactrl.exe
O4 - HKLM\..\Run: [Colorific Control Panel] C:\Program Files\Matrox MGA PowerDesk\Color\hgcctl95.exe
O4 - HKLM\..\Run: [MSCSD] C:\WINDOWS\options\MSCSD.EXE /start
O4 - HKLM\..\Run: [COMSMDEXE] comsmd.exe -off
O4 - HKLM\..\Run: [ICONCLNT] C:\Program Files\Pwrchute\iconclnt.exe
O4 - HKLM\..\Run: [mdac_runonce] C:\WINDOWS\SYSTEM\runonce.exe
O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINDOWS\SYSTEM\hpoopm07.exe
O4 - HKLM\..\Run: [BrowserWebCheck] loadwc.exe
O4 - HKLM\..\Run: [icasServ] C:\WINDOWS\SYSTEM\ICASSERV.EXE
O4 - HKLM\..\Run: [C:\WINDOWS\SYSTEM\nvdsvc32.exe ] C:\WINDOWS\SYSTEM\nvdsvc32.exe
O4 - HKLM\..\Run: [XoftSpy] C:\PROGRAM FILES\XOFTSPY\XoftSpy.exe -s
O4 - HKLM\..\RunServices: [dRMON SmartAgent] drmon\SmartAgt\SmartAgt.exe
O4 - HKLM\..\RunServices: [UPS] C:\Program Files\Pwrchute\ups.exe
O4 - Startup: HPAiODevice.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet K Series\bin\hpodev07.exe
O13 - WWW. Prefix: http://
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcaf...453/mcfscan.cab
O21 - SSODL: xzSqcFsD - {30510DD9-9AFB-A773-42BF-0E0261BE89BE} - C:\WINDOWS\SYSTEM\fo.dll

[dawn]

gerryf

By the way...after waiting for a while and reading a BUNCH of other peoples issues and resolutions....I deleted some stuff from the previous log that I was sure didn't need to be there.

dawn

[gerryf]

uninstall xoftspy in add/remove control panel
it is of dubious worth
check here"
http://www.spywarewa...re.htm#xos_note

download process explorer from here:
http://www.sysintern...e/procexp.shtml

reboot in safe mode, tapping f8 as the memory counts up

run process explorer if you see any of the following in the top window, right click it and choose KILL TREE

runonce.exe
ICASSERV.EXE
nvdsvc32.exe

if you don't see them, don't worry

Start > run, type
regsvr32 /u c:\windows\system\fo.dll
hit OK



Open hijackthis, check the following.
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKLM\..\Run: [mdac_runonce] C:\WINDOWS\SYSTEM\runonce.exe
O4 - HKLM\..\Run: [icasServ] C:\WINDOWS\SYSTEM\ICASSERV.EXE
O4 - HKLM\..\Run: [C:\WINDOWS\SYSTEM\nvdsvc32.exe ] C:\WINDOWS\SYSTEM\nvdsvc32.exe
O4 - HKLM\..\Run: [XoftSpy] C:\PROGRAM FILES\XOFTSPY\XoftSpy.exe -s
O13 - WWW. Prefix: http://
O21 - SSODL: xzSqcFsD - {30510DD9-9AFB-A773-42BF-0E0261BE89BE} - C:\WINDOWS\SYSTEM\fo.dll

hit the fix button, make another hijackthis log and repost.

Check essential programs. We are not removing files at the moment, just settings..if something does not work, we can return it.

[dawn]

Do I do all of this in safe mode?

[dawn]

None of the 3 items listed in first step were there. I did this in safe mode

when I did the Start> run......stuff in safe mode nothing happened. When I did it after restarting I got the following error:

C:\windows\system\fo.dll was loaded but the dll unregister server entry point was not found
dll unregister server may not be exported or a currupt version of C:\windows\system\fo.dll may be in memory. Consider using PView to detect and remove it.

I rescaned with HJT and checked/fixed all the items that were listed. I did get a thing saying it couldn't do a backup of the fixes.

Here is new log.

Logfile of HijackThis v1.99.1
Scan saved at 5:07:49 PM, on 4/20/05
Platform: Windows 95 C (Win9x 4.00.1212)
MSIE: Internet Explorer v5.51 SP2 (5.51.4807.2300)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\DRMON\SMARTAGT\SMARTAGT.EXE
C:\PROGRAM FILES\PWRCHUTE\UPS.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\MGACTRL.EXE
C:\PROGRAM FILES\MATROX MGA POWERDESK\COLOR\HGCCTL95.EXE
C:\PROGRAM FILES\PWRCHUTE\ICONCLNT.EXE
C:\WINDOWS\SYSTEM\HPOOPM07.EXE
C:\WINDOWS\SYSTEM\LOADWC.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\HP OFFICEJET K SERIES\BIN\HPODEV07.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\HP OFFICEJET K SERIES\BIN\HPOEVM07.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\HPOINW07.EXE
\\NTSERVER01\APPS\VIRUS TOOLS DOWNLOADS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.foxnews.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.foxnews.com
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [MGA Control Center] Mgactrl.exe
O4 - HKLM\..\Run: [Colorific Control Panel] C:\Program Files\Matrox MGA PowerDesk\Color\hgcctl95.exe
O4 - HKLM\..\Run: [MSCSD] C:\WINDOWS\options\MSCSD.EXE /start
O4 - HKLM\..\Run: [COMSMDEXE] comsmd.exe -off
O4 - HKLM\..\Run: [ICONCLNT] C:\Program Files\Pwrchute\iconclnt.exe
O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINDOWS\SYSTEM\hpoopm07.exe
O4 - HKLM\..\Run: [BrowserWebCheck] loadwc.exe
O4 - HKLM\..\RunServices: [dRMON SmartAgent] drmon\SmartAgt\SmartAgt.exe
O4 - HKLM\..\RunServices: [UPS] C:\Program Files\Pwrchute\ups.exe
O4 - Startup: HPAiODevice.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet K Series\bin\hpodev07.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcaf...453/mcfscan.cab