[gtswhitt]

I use IE 6.0.2800.1106
WinMe
NIS 2004
OE 6.00.2800.1123
Google Toolbar

I formatted my hard drive about a month ago (I was using WinME), installed WinME again, installed the new NIS CD I purchased, loaded RealArcade games, RealPlayer and all my other programs. The Real Arcade games started freezing where they never did before when I had NIS 2001 and they're the same games I've been using for years.

But my latest problems are three, which are actually the biggest problems aside from the games:

1) I'm getting BSOD, usually just "system busy"
2) And constantly get OE:0197:BFF8E64B which Microsoft's knowledge base has no information on.
3) Over the past couple of days when I use IE I'll be on IE for about 15 minutes and all of a sudden a blank close dialogue box will pop up. Everything freezes. There is no information in the popup except the word "close" and I must reboot. Already today it's happened twice. I'm surprised I've been able to read this forum for this long this time without error.

This seems to have all started when I installed NIS 2004, but I'm not wanting to blame that yet, but I have uninstalled and reinstalled NIS 2004 five times already and I hear they only allow six installs. The reason I've had to reinstall is because right after formatting my hard drive I would get errors that NAV and NIS could not be loaded and it told me to reinstall them. After doing so five times, NIS and NAV seem to be working fine for a month now. I have no clue why that was happening and actually formatted the hard drive a second time to make sure NIS and NAV would work since I had not yet reloaded all of my programs and had time to do so. A few days ago, I decided to reinstall WinME from windows rather than from a formatted drive. It worked and all I noticed was it put back onto my machine some extra stuff I had delete like AOL promos, etc.

Any help would be appreciated. Also, in my msconfig startup I have several duplicated items (see attachment). If you know why, please let me know also.
Thanks
Tina

 

[gtswhitt]

It's Tina again. Just in case somebody asks to see this after viewing my first post, I'll post it and wait for any answer to the first.
Thanks,
Tina

Logfile of HijackThis v1.97.7
Scan saved at 10:12:19 AM, on 1/11/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPROXY.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SNDSRVC.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\S3APPHK.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
C:\WINDOWS\SYSTEM\USBMONIT.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
E:\BACKUPS TO RESTORE\SHORTCUT WORKING PROGRAMS\HIJACKTHIS\HIJACKTHIS[1]\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\UNINST~1\PROGRA~1\SPYBOT\SDHELPER.DLL (file missing)
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: @msdxmLC.dll,[email protected],&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [S3apphk] S3apphk.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMON.EXE
O4 - HKLM\..\Run: [USBMonit.exe] "C:\WINDOWS\SYSTEM\USBMonit.exe"
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MSConfigReminder] C:\WINDOWS\SYSTEM\msconfig.exe /reminder
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ccSetMgr] "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
O4 - HKLM\..\RunServices: [ccProxy] C:\PROGRA~1\COMMON~1\SYMANT~1\CCPROXY.EXE
O4 - HKLM\..\RunServices: [SndSrvc] C:\PROGRA~1\COMMON~1\SYMANT~1\SNDSRVC.EXE
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsearch.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsimilar.html
O8 - Extra context menu item: Backward Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmtrans.html
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O12 - Plugin for .bcf: C:\PROGRA~1\INTERN~1\Plugins\NPBelv32.dll
O12 - Plugin for .mp3: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin3.dll
O12 - Plugin for .mov: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?38331.3275347222
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/10d1bd98fff9c773f520/netzip/RdxIE601.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundler/CAB/RealArcadeRdxIE.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab

 

[gtswhitt]

It's Tina, one more time, just adding to my original post with some more information I discovered.

I was able to get a little past the blank white close popup dialogue box and researched the following items at MSoft.com to no avail.

The next screen gave me a general protection fault KRNL386.exe at 0001:000075a8

At some point I got a low resources message.

Then I got VWIN32(05) + 00000038 Error:OE:0028:C02A3F13

Then I got the original 0197:BFF8E64B error once again as I mentioned in message #1 above.

These all occurred right after the blank white close box when I was using IE and before I restarted the computer.

My resources seem fine. I'm running at 68% free on my resources. I wasn't multitasking. I look at my computer's properties and my RAM is 248MB. I have checked off to let Windows manage my virtual memory settings and inside the grayed out hard disk box it says C:\20833MB Free. Windows is on my C:drive and I have over 20GB free.

Thanks again for any help. I'm thinking this may be all someone needs to figure this out. Any help or direction would be appreciated.

Tina

 

[bandit429]

Hey there Tina,,,I just saw your thread,,Im looking it over now..be patient please.

 

[bandit429]

This is what I found at MS knowledgebase,,let us know if it helps,,,scroll down to the errors part and at the last you will see yours.. click the link below and good luck.

http://support.microsoft.com/?kbid=141930

 

[gtswhitt]

Thanks for looking up some of those error code numbers, but I'm afraid that doesn't help at all. I don't have MS Works on my computer and none of those other issues are the same as mine. Only part of the error numbers match the ones you led me to, but they're not the same numbers.

Any other suggestions would be appreciated.

 

[abadaba]

Thanks for looking up some of those error code numbers, but I'm afraid that doesn't help at all. I don't have MS Works on my computer and none of those other issues are the same as mine. Only part of the error numbers match the ones you led me to, but they're not the same numbers.

Any other suggestions would be appreciated.

This will fix all this,trust me.unckeck most of this junk.
:up:
You can always go back to normal though.

 

[gtswhitt]

This will fix all this,trust me.unckeck most of this junk.
:up:
You can always go back to normal though.

Hi, I'm not sure what you mean. Are you talking about where Bandit lead me? Uncheck what?

 

[bandit429]

I did notice one weird thing in the screenshot you sent,,,a checked box with nothing out from it. Did nt you say it ran fine for a while? Try a virus scan,,even though you have NIS installed it may be worth a shot. Click below,,its free. Also you may try unchecking that box and restarting then look to see if it remained unchecked.

http://www.pandasoftware.com/active...guage=2&Country=63&Partner=1&Ref=EN-PR-AS-107

 

[abadaba]

Hi, I'm not sure what you mean. Are you talking about where Bandit lead me? Uncheck what?

Sorry but i thought you knew about msconfig.exe
Use the run menu
and selective startup.Heres what mine compares to your hijack.

 

[gtswhitt]

I did notice one weird thing in the screenshot you sent,,,a checked box with nothing out from it. Did nt you say it ran fine for a while? Try a virus scan,,even though you have NIS installed it may be worth a shot. Click below,,its free. Also you may try unchecking that box and restarting then look to see if it remained unchecked.

I noticed that long ago too and tried to find something out about it and never did, so I left it there.

Since I talked to you last, I've been searching forums and I found the program PC Bug Doctor and then found CCleaner (formerly Crap Cleaner) and I compared what Bug found to CCleaner and decided not to pay for Bug but used CCleaner and it must have delete that blank line because it's no longer there.

The double entries are still there though for Tkbell and Load Power Profile. I had unchecked them before but I suppose when using those programs they automatically added back again but don't use what was there. I'm wondering now how to delete the extra ones. There's probably no harm done though on that.

In reference to virus stuff. I scan almost weekly and today also ran Lavasoft's Adware and used Spybot today also before using the hijack log. That blank msconfig startup line has been there forever, so any virus scanning would have picked it up before. But I'm glad CCleaner got rid of it.

Also, in reference to the Microsoft knowledge base you led me to, I went ahead and unistalled my printer and grabbed new drivers from Hewlett Packard and resinstalled everything there. That's the only thing I can think of doing from your search of that article since I don't have MSWorks. I'm not sure if I got a new driver or not or always had the same one, but that's taken care of anyways.

I'm running the Panda Virus checker right now. It's approaching 30,000 files scanned so far and has found nothing yet.

That CCleaner really worked well. I'm hoping maybe something it cleaned up will help with most errors. I'll let you know in over the next couple of days if it's fixed.

If anyone else knows something about this too, I'll sure take more help since I still don't know yet if anything's going to go belly up yet.

 

[gtswhitt]

Sorry but i thought you knew about msconfig.exe
Use the run menu
and selective startup.Heres what mine compares to your hijack.

Okay, I was wondering what you were talking about since you quoted Bandit in your message to me. Yeah, I know about MSCOFIG, but gosh, I'm not sure about unchecking all the stuff I've left checked. Most is Antivirus and Security and the WindowsMe management stuff that were on the system when I purchased it and I've unchecked all the programs that don't need to run that I've installed myself. I've looked it all up and I'm kind of afraid to not let them run.

Since your checked and unchecked startup items don't resemble mine and you seem like you might be new to this too, I think I'll wait until someone is more precise about my startup items. I'm sure you won't mind. I'd really like to know for sure what stuff is, like load power profile, etc. are.

p.s. I'm still getting a message about being low on resources. I haven't tried the Real Arcade games yet to see if they gliche and dissapear while playing them, but I'll let you all know by tomorrow evening if things seem to be fixed.

 

[gtswhitt]

Hey Aba....I just noticed you have Rundll twice in your start up. So my issue of having stuff twice now seems kind of obvious to me. At one point you unchecked it and it loaded again when the computer was turned off or on. That must be why mine reloaded too and a couple now show twice because they must be used. That's interesting.

If I don't hear back from anyone about these, I'll take your suggestion and uncheck some of the windows management stuff. If it reloads (duplicates in the startup items, then it's needed and if not, then maybe things will work better). But I'm just going to wait a bit for someone else to speak up on this. Thanks
Tina

NOTE TO BANDIT.......PANDA found no virus either and checked 61,409 files on my C:drive.

 

[gtswhitt]

Gdnight then
:down:

Good night.

Could you do me a favor and delete those really long quotes on the two messages of yours above? Thanks.

Edited: Oh, and by the way, sorry about that. I looked back and you didn't quote Bandit but did indeed quote me, but the topic quoted didn't match. That's why I got confused on what you were saying.

Thanks, if you'll delete those long quotes in your messages.

 

[abadaba]

Good night.

Could you do me a favor and delete those really long quotes on the two messages of yours above? Thanks.

Edited: Oh, and by the way, sorry about that. I looked back and you didn't quote Bandit but did indeed quote me, but the topic quoted didn't match. That's why I got confused on what you were saying.

Thanks, if you'll delete those long quotes in your messages.

Their not mine but someone elses quote to stress a point.
So ask them.Mine are short and to the point and ignored.
:down:

 

[abadaba]

oops where getting crossed up.

 

[gtswhitt]

Their not mine but someone elses quote to stress a point.
So ask them.Mine are short and to the point and ignored.
:down:

Could you delete them anyways? Thanks.

 

[gtswhitt]

oops where getting crossed up.

LOL.....that's why these forums can be fun! We have to use our brains to work through what in the heck we're all talking about!

That's kind of the reason to delete those long quotes in yours since all you said was goodnight and quoted everything back to me. Kind of makes it all messy.

Have a great night! I think it's way past my time to hit the hay. I'll let you know tomorrow if your suggestion came through for me. I usually don't like to wait before I try something, so I'll probably do what you said just to see what will happen.

 

[abadaba]

rundll32 runs many system things and as long a you have it it doesn't have to be running all the damn time.

 

[gtswhitt]

rundll32 runs many system things and as long a you have it it doesn't have to be running all the damn time.

No, I guess not......only just about every other 30 seconds or so. LOL