Win98se problems after installing NOD32

Hi All,
After I downloaded and installed the NOD32 antivirus free month trial, my windows98se OS would not fully bootup.
I went into " Safe Mode " and ran windows scandisk.
Scandisk found an error which it could not fix, something about a file with a long filename.
So while still in " safe mode " I went into windows control panel and removed NOD32. After that my windows98se O.S. started as normal.
I sent a message to support at NOD32, and they replied that the problem was a windows problem not a NOD32 problem. They also said that my windows98se OS was corrupt. Which could be true as I am unable to virus can with McAfee, Trendmicro or NOD32.
It is possible that my system was infected before I installed McAfee.
Although I cannot scan for viruses, everything else appears to be working
alright.
Can anyone on the forum suggest some fixes,so I can virus scan please?.
Regards, Robert

 

I think you need to fix the long filename problem, that is why the file scanning programs are not working.

I have had problems with automatically generated filenames using Word.

Matt

 

Hi Mattman,
It took me two nights to windows scandisk my two drives, takes all night to scandisk one drive, about 6 hours.
Both drives were free of errors according to scandisk.
No mention of the file with a long filename?.
The above was done after NOD32 was removed. So it seems the NOD32 antivirus program must have had something to do with it.
One poster on another forum here in Australia, said that I should have not just disabled McAfee virus scan and firewall but un-installed them both plus another antivirus program called A Squared Free. He said it says so on the NOD32 website. I did not notice this myself.
So would you think this would cause the problem I had with NOD32?.
Also my PC crashed in a internet site I was in today.
I had to close one of the internet sites I was in for it to function.
I only had 2 websites open at the one time.
I am using MS internet explorer version 6 as I cannot use version 7 with win 98se
This seems to be a memory problem to me, probably caused by viruses?.
Also can someone tell me what year MS windows XP OS came out?.
I am thinking I buying the upgrade from 98 to XP.
My MS office program is version 97.
Could I use this be succesfully used with XP?
If I have to upgrade both programs, this would be beyond me financially at this time. I paid $600AU for my office programe in 1998.
Regards, Robert

 

Hello raldridge,

After reading your two posts, I think choose between two courses of action:

One, clean up this current installation, all the signs point to malware/virus infection either by a clean re install of 98 if you can or by going thru this thread and post a High Jack this log in the malware/virus removal section on this Board. Read http://www.windowsbbs.com/showthread.php?t=37074 then post a HijackThis log in the Removing Spyware & Viruses forum. Don't even think about upgrading to XP in its current condition.

I would also uninstall all your currently installed AV's - then settle on one and re install it. Having concurrent AV's - whether running or not, will cause problems.



Or two, install XP cleanly http://www.helpwithwindows.com/WindowsXP/setup.html

Can't tell you whether Office 97 is compatable with XP - I should think it would be, but you have to make sure. The XP install disc has a test for compatibility option before you upgrade.

XP came out in October 2001.

Regards - Charles

 

Unable To Scan For Viruses

Hi All,
I am unable to scan with AV software off line, and I have just tried to scan with Panda online scan and my system froze, meaning the mouse still moved across the screen but my system would not respond from any inputs from keyboard or mouse. I have win98se OS.
It froze then went out to the DOS screen where it said press control alt delete to restart or press any key to continue. I did the latter, it then went to the desktop where it would not respond to any inputs.
I then had to press the re-set button on the CPU to restart my PC.
Before trying to update the Spybot before scanning with it, once again my PC
re-booted it'self with out any input from me.
I have downloaded and run the Hijack this log programe, on responce to people on the Windows BBS forum. As I am a computer dummy, this was all new to me. I had not heard of, leave alone used the HiJack this log programe before.
I will try to paste the contents of the above program's log file at the end of this message.
I have two hard drives on my PC, C:\ and D:\, and I have McAfee antivirus and McAfee firewall installed. At first I was able to scan both drives with McAfee. But it will not scan either now.
Hoping someone will have some ideas on how to clean my PC,which is not too expesive as I am trying to survive on a very low income.
Also I hope I will not need to reformat my two hard drives, as I would then lose my data.
I will now try to paste the contents of Hijack this log from it's log file.
Regards, Robert

Logfile of HijackThis v1.99.1
Scan saved at 2:43:36 PM, on 2/01/07
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCSHLD9X.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\OASCLNT.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHLD.EXE
C:\PROGRAM FILES\MCAFEE.COM\AGENT\MCAGENT.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSESCN.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\PL15CO98.EXE
C:\PROGRAM FILES\SCREENPRINT32 V3\SCREENPRINT32.EXE
C:\WINDOWS\MIXER.EXE
C:\WINDOWS\SYSTEM\USBMONIT.EXE
C:\PROGRAM FILES\MCAFEE.COM\AGENT\MCTSKSHD.EXE
C:\PROGRAM FILES\MCAFEE.COM\PERSONAL FIREWALL\MPFTRAY.EXE
C:\PROGRAM FILES\MCAFEE.COM\PERSONAL FIREWALL\MPFAGENT.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\ANTISPYWARE\HIJACKTHIS.EXE

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://pcworld.idg.com.au
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHL.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [HI-SPEED USB DEVICE Coinstaller] PL15Co98.exe
O4 - HKLM\..\Run: [CriticalUpdate] C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\Run: [ScreenPrint32] C:\PROGRAM FILES\SCREENPRINT32 V3\SCREENPRINT32.exe -startup
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [Gene USB Monitor] C:\WINDOWS\SYSTEM\USBMonit.exe
O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\MCAFEE.COM\AGENT\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\MCAFEE.COM\AGENT\MCUPDATE.EXE
O4 - HKLM\..\Run: [MCTskShd] C:\PROGRA~1\MCAFEE.COM\AGENT\mctskshd.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\MCAFEE.COM\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\MCAFEE.COM\VSO\MCMNHDLR.EXE" /checktask
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKLM\..\RunServices: [KB918547] C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE
O4 - HKLM\..\RunServices: [McShld9x] C:\Program Files\McAfee.com\VSO\mcshld9x.exe
O14 - IERESET.INF: START_PAGE_URL=http://pcworld.idg.com.au
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab
O16 - DPF: {EFAEF0E4-F044-4D57-9900-1C3FF18524C9} (AV Class) - http://pcpitstop.com/antivirus/PitPav.cab

 

Robert,

there are two diffirent versions of nod32.
A Windows XP/2000/NT version and a seperate product a Win 98/95?hated ME version.
You would not think the wrong version would install but who knows ?
Try taking out the other antivirus product if possible. Reboot. Then try installing what you know is the proper NOD32 version.
By the way a number of senior techs at the local Best Buy whose main career is either to remove viruses/spyware/malware as well as to advise customers that the wisest thing to do i to buy anew computer (with the extended service plan as you see what can happen to your new computer as well as the cost of removing these horrible things) report that in their experience the product NOD32 seems to find and remove difficult lurking viruses that the other products ( read Norton the market leader in market penetration) do not find or remove.

link for NOD32 Win 98 version download:

http://www.download.com/NOD32-Stand...-98-Me-/3000-2239_4-10475646.html?tag=lst-0-2

 

Hi all

Yes Office 97 is supported by XP

Yes NOD32 is very good these days worthy of use is aggressive and because of this does generate some false positives. And the install should have detected windows 98 but may not have.

If you go back with NOD make sure you do in fact have the correct version.

I don't want to interfere with the suggested HJT scan but it can be run before or after a clean up and will still find culprits if any are left.

The length of the scans and defrags (depending on speed of CPU and HD and the size of the HD) indicate to me 2 things.

1. Some culprits will interfere with scan and defrag but apparently here they did not. Not to say you don't have any, most likely you do. But not the type that are running in memory and try disk access frequently.

2. Large un-cleaned temps will cause scan and defrag to take a long time.

Also by cleaning up first, you may just throw some of the germs in to the drain.

Since the temps could be huge if you haven't cleaned them it could take much much longer to scan and clean ( same as the scan defrag) since we are scanning files that shouldn't be there anyway.

So I would recommend a deep cleanup first.

Not required but I would check Add/remove for any old programs you no longer use and un-install them along with the above recommendation to clear out the NOD etc. You can and will need to chose and install a good Virus scanner later.

My suggestion:
In full mode download and install the following but do not run them, do that in safe mode.


DCleaner http://www.majorgeeks.com/DCleaner_d4790.html

CCleaner get the slim version http://www.ccleaner.com/download/builds.aspx
Run the Temp cleanup then the issues (registry) untill they come up with nothing.

EasyCleaner http://personal.inet.fi/business/toniarts/files/EClea2_0.exe

EasyClean does it all but stay away from Duplicate file cleaning (especially Windows OS files) unless you are sure of what you are doing.

http://www.xblock.com/download/xclean_micro.exe
Advanced Spy/adware cleaner (goes not after everything but only the worst and most prevelant) use SpyBot and Adaware later after this.

Do them in the order as above with xclean_micro last.

Then do McAfee

The stand alone Mcafee virus cleaner
http://home.hccnet.nl/h.edskes/mirror.htm

Mike

 

Hi Mike,
I tried to carry out your instructions re cleaning my PC.
But I kept getting the " this program has performed an illegal operation " so could not continue.
Except the one you said to scan last with.
While I was attempting to install it,it straight away started scanning in ordinary mode. It also wanted to access the internet.
I also downloaded the correct version of NOD32 and was able to install it fully this time.
Like most of the other AV programs it listed and scanned drive C ok, then crashed when in the Grissoft folder on my old D drive.
I used to run the AVG antivirus program when my old D drive was my C drive.
When I tried to restart windows, after the part done NOD32 scan it would not fully boot up. Just like before with the in-correct version of NOD32.
So once more I had to boot-up in " safe mode " and uninstall NOD32 from control panel.
NOD32 found a lot of files, some it could not open. I remember the first one was a windows system file.
But when I un-installed NOD32 I lost the log file as well.
It looks like the viruses are winning the war so far.
I posted a message on the Removing viruses board with a Hijack this log file pasted at the end. Sorry I cannot remember the subject title I posted it under, but it would have been posted close to 24 hours ago.
Regards, Robert

 

Good morning raldridge

I didn't understand, did you get them all downloaded OK?

Did you get errors when you installed them?

Or when you tried to run them?

And you got the exact same error on each programs when you tried to run them?

If they downloaded and installed OK, were you trying to run them in safe mode as directed?

Please Clarify the above!

If they did install properly and you were running in safe mode then do the following in normal mode.

Hit Ctl Alt del to get to task manager.

In taskmanager 1 by 1 end all programs except Explorer and SysTray. It may take up to 3 times to kill certain processes and you may have some that will not go.

We need the exact names of these when you report back.

But continue when you have ended all you can end.

Then use MY Computer to browse to the Grisoft folder. Select and delete it.

Then empty the Recycle bin.

Then Click Start-Run
type
command
and hit enter

then
type
c:\windows\command\deltree c:\temp\*.* /y
and hit enter (space after deltree and after *.*)

next
type
cleanmgr /sageset:99 and hit enter
select all check boxes and click ok

next

type
cleanmgr /sagerun:99 and hit enter

let it run based on your other runs it could take a long time, you should see disk activity if you have a HD light and may hear the HD as it works.

When it returns to the command prompt
type
exit

Should be back at desktop

Then try to run all the listed programs in normal mode.

Report back at this point. Please give more specific details..

Mike

 

Hey Robert

I missed in you last message (to me above that you had posted a HJT log)
and could not find it. Sorry!

Here is a link to it:
http://www.windowsbbs.com/showthread.php?t=60858

It dosen't show a lot that I didn't already know or suspect, BUT!

I did notice that you had a Mcafee suite installed that included a firewall etc.

This could cause a problem togather with NOD. Especially if we do not know if it is damaged. Some Viri can disable a Virus scanner.

There is a difference between a Virus Scanner (usually means in is running in memory and actively watching for Viri) and a Virus Cleaner like the Macfee Virus cleaner that (as I list above) does its job and leaves when you exit. Usually the cleaner is more specialized.

So when you end the processes as mentioned in my instructions make sure that your McAfee suite is disabled also if possible before running the programs I advised.

Do not uninstall it yet just stop it while you are doing the above process.

All that you stop with Taskmanager will return when you reboot.

Mike

 

Hi Mike,
Thanks for your reply.
Yes, I was able to download and install all the 4 programs you mentioned.
As I said previously the last program started to scan while I was still in normal mode, and I could not find a button to stop it.
Now when I booted into " safe mode " and tried to scan, on all of the programs except the xclean one I got the error I mentioned before " this program has performed an illegal operation " etc, and they would not run from that point. And this was at the start of the scan for each. As you said scan with the other 3 first I did not scan with xclean whilst I was still in " safe mode ".
I will now carry out your intructions as per your last post.
I will report back when I have at least tried to carry out your last instructions.
BTW when you said before do a McAfee, I presume you meant run my McAfee already installed virus scan, not an online McAfee virus scan if there is such a thing?.
Regards, Robert

 

Ok Robert

Ending the programs in memory (taskmgr ) may make the difference.

But any of these programs that will run let it complete normal mode or what ever.

Mike

 

I see nothing in the log out of the ordinary.
I do have a recommendation to remove this entry, and then delete all the files in the C:\Windows\Applog folder.

O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe

What this does is monitor what files you are opening, so when you defrag your programs supposedly are arranged to start up faster, about a few microseconds. It is not really worth it, considering the extra time Defrag spends rearranging your hard drive.

You can also remove this one, microsoft isn't putting out any more critical updates for 98.

O4 - HKLM\..\Run: [CriticalUpdate] C:\WINDOWS\SYSTEM\wucrtupd.exe -startup

Part of your freeze up can be due to a buildup of temp files. There is a good way to clean these, but not in windows. To do these, Shutdown the computer, but instead choose the option to Restart in Dos Mode.
When you get the blinking prompt, type in these lines pressing Enter at the end of each.

smartdrv
del c:\windows\*.tmp
deltree c:\windows\cookies
deltree c:\windows\history
deltree c:\windows\temp
deltree c:\windows\tempor~1
Note; you find the ~ to the left of the 1 key.
Type a Y that you want to delete when prompted, check for typos at this time. You wouldn't want to delete the entire windows folder, just those.
When done reboot the computer. Those folders will be recreated clean.
When windows is up, now would be a good time to defrag, and then do your scan.

About reformatting, and you having two hard drives. If needed, only one would be needed to be done, the drive with windows on it. Any files could be transferred to the second drive.

 

Hello Robert

Hope all is going well in the cleanup.

Markp62 found your first post and posted some help. Click the link above to get back to your first post and read his post and do what he recomends also.

His post has a few things that that seem the same (the deltree part) but he as more and by diong it in dos mode as he recomends it will be better.

Take his advice and use HJT to remove the items he mentions.

Mike

 

Hello Mark

Long time no see.

Best to you.

raldridge posted here and lost it. Just this evening I found it and notified him of its location.

To bring you up to date see:
http://www.windowsbbs.com/showthread.php?t=60663

Later
Mike

 

Hi Mike,
You are a genius,using your instructions actually made it possible for McAfee to scan both drives for the first time in ages. I was beginning to think I would never see this again.
And it found a worm virus called " w32/Stration qen.dldr " in my Qualcom folder which houses my Eudora email client.
While it was scanning on my D drive I noticed there were more than 60,000 to 80,000 Windows temporary internet files on this drive.
So after McAfee had finished virus scanning both drives I went into my D drive with the intention of removing all of these.
When I got to the temporary internet files folder I found in it quite a few sub folders, so I selected one to delete.
It took about 20 minutes to delete the just over 1,000 files in this one sub folder
Also it found a windows system file which it wanted me to confirm before deleting it, which I responded with no.
Is there a quicker way to delete these temporary internet files, without deleting any system files?.
Now I still have the problem with NOD32, because when this very good AV is installed I can not fully reboot my win98se OS.
Or at least I could not before today's cleanout.
I believe that NOD32 does check things everytime one re-starts the PC.
So it is probably something to do with this which is causing the problem.
Now that I have removed Grisoft and AVG7 from my all users application data folder on my D drive I reckon NOD32 will now fully scan both my drives .
I have a deal with my ISP to pay each month $ 5 each for McAfee virus scan and McAfee personal firewall, a total of $10 per month added to my broardband internet bill.
As you said Mike, running two AVs on one system is not recommended.
I could be committed for 1 or 2 years with this deal with my server with McAfee.
I would still like to have my months free trial of NOD32, but to do that I would have to resolve this booting-up problem with NOD32 installed?.
Which is the title of this thread.
Thanks very much Mike, with your help so far with my problem.
Much appreciated.
Regards, Robert

 

Unable To Scan For Viruses

Hi Mark,
Thanks for your reply.
With the help of Mike, I was able resolve my problem of not being able to scan for viruses with my installed McAfee AV program.
It turned out to be fixed by cleaning out my system of unnessary files.
And by deleting files and folders that were stopping scanning programs from operating properly.
If you would like to read my other thread it is on the win95/98ME forum with the title of " win98se problems after installing NOD32 "

When the technician installed my two drives I noticed that there were windows system files on both drives, but my original C drive is now my D drive.
He probably used my D drive as a backup and as a slave drive.

Regards, Robert

 

Robert

While you are into it!

Do the steps above that Mark instructed with HiJackThis check the 2 items and remove them:

O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe

O4 - HKLM\..\Run: [CriticalUpdate] C:\WINDOWS\SYSTEM\wucrtupd.exe -startup

The below steps are optional since your problem is fixed but will help in performance and stability. I would do them.

Boot to dos as Mark instructs and do his deltree commands

but add these other to the bottom of his

deltree /y c:\win386.swp
deltree /y c:\windows\win386.swp
deltree /y c:\windows\taskmon.exe
deltree /y c:\windows\shelli*.*
deltree /y c:\ffast*.*
deltree /y c:\progra~1\micros~1\office\1033\findfast.*
deltree /y c:\windows\downlo~1\*.*
deltree /y c:\windows\offlin~1\*.*
deltree /y c:\windows\applic~1\micros~1\office\shortc~1\off*.tmp
deltree /y c:\windows\applic~1\micros~1\office\shortc~1\des*.tmp
deltree /y c:\windows\applic~1\micros~1\office\recent\*.*
deltree /y c:\windows\applog
c:\windows\command\scanreg.exe /fix
c:\windows\command\scanreg.exe /opt

Remember these deltree commands must be done from real dos so follow Marks instructions to boot to dos mode.

After you complete all of these cleanups you should defrag again since removing lage chunks of temp and useless files has fragmented the disk again.

Mike

 

Morning Robert

Fantastic, you do good work! You are allright, I don't care what all the others say!

I just posted additional cleanups in your other post. Added to Marks process. I would do these.

Now in finalization ( i "lernt" to use big fancy words from another member of this BBS) ".

I would reccomend the following:

1. Forget NOD keep the McAfee up to date.

2. Cleanup the other drive if all you are using is on c:

At least get rid of the Windows folder on the other drive.

The file you mentioned is recognised as a windows file even if on another drive but it is not used as you are now using c: so they can be removed, are a waste of disk space and cause the delays in Virus scanning, disk scanning etc.

The Program files on the other drive can also be removed. Most likely you could remove all if you have not told a program to install there or you have explicidly stored data there.

Time is short for me now but later today I will post links to a couple of Virus cleaners to use in place of the nod.

Mike

 

Hi Mike and Robert,

Merged the thread from the Removal section with Robert's original thread.

Regards - Charles