[anthonyHSV]

Ask to look at a users home PC. Its Win98 upon startup after the desktop icons and startbar appears a error message pops up stating Explorer will crash. Click close and explorer will crash and then load then loop round to the error message again.

The details of the error is EXPLORER caused and invalid page fault in module OLE32.DLL at 0167:7ff2Ia32.

Same occurs in safe mode.

Plugged the PC's HDD into another PC as a slave and removed about 25 different types of Trojan's using E-trust antivirus from the drive yet still no luck.

Can someone please help me out here

[Advertisements]

Boot the PC to command prompt only, type scanreg.exe /fix then press enter, if it runs and says repaired see if you can get to system tools, system information, tools, system file checker to scan and replace missing files from Windows CD

Malware will get in the way of any fixes so try to get Hijack This on there

[Retired Tech]

Boot the PC to command prompt only, type scanreg.exe /fix then press enter, if it runs and says repaired see if you can get to system tools, system information, tools, system file checker to scan and replace missing files from Windows CD

Malware will get in the way of any fixes so try to get Hijack This on there

[anthonyHSV]

Hi Keith,

The scanreg hangs on checking the system.dat file. I loaded Hijack this onto the desktop via Dos to attempt to click and run it before I get the error message. However I'm not getting anywhere

[Samm]

Try this :
boot from win98 startup floppy disk (it must load cd rom drivers & have extract.exe on it)
Insert the win98 CD
at the dos prompt, change to the win98 folder on the CD (eg D:\win98)
type :
extract /a /y /e /l c:\windows\system win98_36.cab ole32.dll <enter>
extract /a /y /e /l c:\windows base4.cab explorer.exe <enter>

Reboot the system in safe mode & see if you can now run hijack this

[anthonyHSV]

Hi guys did as you say and no luck..

How close am I to Format C:\ ???

Edited by anthonyHSV, 27 July 2005 - 07:08 PM.

[Samm]

Hi guys did as you say and no luck..

How close am I to Format C:\  ???

Not far off!
Theres a few more avenues to explorer first though :
Try booting to command prompt again
Change to c:\windows\command
then type scanreg /restore

This will let you select a registry backup to restore. Obviously you want to choose the restore dated just before the problem occured

[anthonyHSV]

scanreg /restore failed

However since then I'm now back into the PC I have A hijackthis log..

Logfile of HijackThis v1.99.0
Scan saved at 11:03:18 AM, on 7/29/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\AHEAD\INCD\INCD.EXE
C:\WINDOWS\ALL USERS\DESKTOP\HIJACK~1.EXE
C:\PROGRAM FILES\REAL\REALPLAYER\REALPLAY.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKUFIND.EXE
C:\PROGRAM FILES\SECOND COPY 97\SC97.EXE
C:\PROGRAM FILES\PLAXO\2.3.6.2\INSTALLSTUB.EXE
C:\WINDOWS\ALL USERS\START MENU\PROGRAMS\STARTUP\HIJACK~1.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKCALREM.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.telpacific.com.au
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,(Default) = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://4-counter.com/?a=2&b=cris
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://4-counter.com/?a=2&b=cris
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by TEL.PACIFIC Pty Ltd
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\PROGRAM FILES\MYWAY\MYBAR\1.BIN\MYBAR.DLL
O2 - BHO: MyWay Search Assistant BHO - {04079851-5845-4dea-848C-3ECD647AA554} - C:\PROGRAM FILES\MYWAY\SRCHASTT\1.BIN\MYSRCHAS.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: (no name) - {0E1230F8-EA50-42A9-983C-D22ABC2EEB4C} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\PROGRAM FILES\MYWAY\MYBAR\1.BIN\MYBAR.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe

[Samm]

OH DEAR!

Get yourself along to the malware forum & post the HJT log in there

[Kat]

Hello. It is obvious you are using this site to fix computers you are getting PAID to fix. That is a giant no no here. The people who are Staff members here donate their time and expertise to help people fix their pc's. We do not appreciate helping you for FREE so you can get paid.