Fatal exit code 0X200 flashing and siren going off when shutting down

While shutting down my computer, it goes through all the stages including the "Windows 98 is shutting down" page, then the screen goes black, a piercing siren starts sounding and a small message flashes on and off in the upper left hand corner: "Fatal exit code 0X 200" flashes. The only way I can then shut down is the use Ctrl + Alt + the OFF button or unplug it. The frequency is increasing. This happens whether I have been on-line or not. Can someone help?

 

This sounds like some software you have running, as windows itself does not blare off sirens. It sort of reminds me of the siren that a AV program name eSafe Desktop would make if a system file was being renamed, or if something was added into startup, never had an error with it, though.
What do you have running at startup and is running in the background?

 

Fatal exit code

As far as I know nothing special is being run. It is a laptap and the touch pad program, the time/date program and other what I think are standard things. Is there a way to check what is running at start up and in the background? Thanks for your help.

 

HijackThis
Download and install. When running , click on Config, then Misc Tools. Now click on Generate Startuplist Log. It will open in Notepad. Then Copy and Paste into a post here.

 

PK

 

As you can see from the previous, I am having trouble. When I try to copy, all but a few random lines disappear and most of them disappeared when I copy. I brought the laptop home and am about to try again.
Thanks for sticking with me.

 

When I try to download HighjackThis, I get a downloaded file of code, not the page shown in the instructions. Any suggestions?

 

Do you have a popup stopper, or any download manager installed?
If you tried to Copy and Paste directly from HijackThis window, you will have trouble. When HijackThis creates a StartupLog, it opens in Notepad, pure text, and will appear as something like this.

StartupList report, 10/13/03, 7:41:53 PM
StartupList version: 1.52
Started from : D:\PROGRAM FILES\HIJACK\HIJACKTHIS.EXE
Detected: Windows 98 SE (Win9x 4.10.2222A)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
C:\PROGRAM FILES\KERIO\PERSONAL FIREWALL\PERSFW.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\OUTLOOK EXPRESS\MSIMN.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
D:\PROGRAM FILES\HIJACK\HIJACKTHIS.EXE

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

SystemTray = SysTray.Exe
ScanRegistry = C:\WINDOWS\scanregw.exe /autorun
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
AVG_CC = C:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
Avgserv9.exe = C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
PersFw = "C:\PROGRAM FILES\KERIO\PERSONAL FIREWALL\PERSFW.EXE "

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=Explorer.exe
SCRNSAVE.EXE=
drivers=mmsystem.dll power.drv

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 10/10/2003, 22:48:6)

[rename]
NUL=C:\PROGRA~1\GRISOFT\AVG6\$AVGUPD$.BKP

--------------------------------------------------


Enumerating Browser Helper Objects:

(no name) - D:\PROGRAM FILES\DAP\DAPIEBAR.DLL - {0096CC0A-623C-4829-AD9C-19AF0DC9D8FE}
(no name) - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Tune-up Application Start.job
Maintenance-ScanDisk.job
Maintenance-Defragment programs.job
Maintenance-Disk cleanup.job

--------------------------------------------------

Enumerating Download Program Files:

[Update Class]
InProcServer32 = C:\WINDOWS\SYSTEM\IUCTL.DLL
CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37872.9051041667

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\DIRECTOR\SWDIR.DLL
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

WebCheck: C:\WINDOWS\SYSTEM\WEBCHECK.DLL

--------------------------------------------------
End of report, 3,940 bytes
Report generated in 0.267 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

 

I just did a search. There is no popup stopper. There is an Adobe download manager and an Active X cache folder. There are no folders in the Adobe and the Active X is an update file.

When I download, I get a message that the program is too big to open in NotePad, do I want to use WordPad. I click yes and it opens up as code; nothing like the example given at the web site or the example you give.

Could this be the reason? I had to crash the computer (with online assistance from the manufacturer) about a year ago. I could not find my disc for Word 2000 and never did anything about it since I have a desktop at home. Do I need Word to use WordPad?

Amend my competency level to less than a beginner.

Again thank you for your assistance and your patience.

 

Now I see what your problem is. You need Winzip, download the evaluation version and install. This will work for you forever as it never seems to expire.
HijackThis comes as ZIP file, and you need Winzip to open it. It will extract it to a folder of your choice.

 

In the meantime, click on the start menu, select Run, and type "msconfig" without the quotes. Click on the tab labelled "Startup" and tell us what in there. Maybe you won't have to go through the entire process of downloading and installing Winzip, thne doing the same for HiJackThis

 

I downloaded the Winzip and again downloaded HighjackThis. When I try to open it I get the following message: A required .DLL file, <SVBVM60.DLL was not found.

When I ran msconfig I got the following:
Yahoo Pager (its for Yahoo messenger which I don't use, but I do use Yahoo as a home page, and for a mail address)
Scan Registry
Task Monitor
System Tray
SynTPLpr
SynTPEnh
CPQEASYACC
Service Connector
Critical Update
TkBelExe
OEM cleanup
Load Power Profile
Load Power Profile (I unchecked this one)
Scheduling Agent
Webshots
Win Zip Quick Pick

 

That tells me that you do not have the Visual Basic 6 runtime files installed. You just as well get them, as you may run across that message again.

CPQEASYACC allow you to use the Multimedia keys on your keyboard, if you do not use them you can disable

Recheck the second PowerProfile entry, it should be there.

Service Connector < That is another name for Backweb, can't be sure as you did not put the name of the executable. Part of the stuff that Compaq puts on their computer. Disable it.

SynTPLpr and SynTPEnh are for the TouchPad on your laptop.

Taskmon, you can disable this, it is supposed to keep track of which apps you use the most, so when you Defrag, the drive gets optimized for faster access to these programs.

You can disable Ypager, and the Winzip quick pick.

I can easily see that you do not have a AV program or a firewall. You can get them free.
AVG AV for free
Kerio Personal Firewall

I do not see anything that would make a siren noise. Maybe someone else will ring in.

 

Logfile of HijackThis v1.97.3
Scan saved at 7:09:49 PM, on 10/15/2003
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPLPR.EXE
C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPENH.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\CPQEADM.EXE
C:\CPQS\BWTOOLS\SCCENTER.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\EVNTSVC.EXE
C:\PROGRAM FILES\WEBSHOTS\WEBSHOTSTRAY.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\BTTNSERV.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\EAUSBKBD.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\WINZIP\WINZIP32.EXE
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.presario.net/scripts/redirectors/presario/srchredir.dll?c=2c00&s=searchbar&LC=0409
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.presario.net/scripts/redirectors/presario/srchredir.dll?c=2c00&s=search&LC=0409
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://desktop.presario.net/scripts/redirectors/presario/deskredir.dll?c=2c00&s=consumer&LC=0409
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.presario.net/scripts/redirectors/presario/srchredir.dll?c=2c00&s=searchbar&LC=0409
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.presario.net/scripts/redirectors/presario/srchredir.dll?c=2c00&s=searchbar&LC=0409
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
O2 - BHO: Yahoo! Companion BHO - {13F537F0-AF09-11d6-9029-0002B31F9E59} - C:\PROGRAM FILES\YAHOO!\COMPANION\YCOMP5_0_2_3.DLL
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\YCOMP5_0_2_3.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Service Connection] c:\cpqs\bwtools\sccenter.exe
O4 - HKLM\..\Run: [CriticalUpdate] c:\windows\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot
O4 - HKLM\..\Run: [OEMCleanup] C:\WINDOWS\OPTIONS\OEMRESET.EXE
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Translate (HKLM)
O9 - Extra 'Tools' menuitem: AV &Translate (HKLM)
O9 - Extra 'Tools' menuitem: &Find Pages Linking to this URL (HKLM)
O9 - Extra 'Tools' menuitem: Find Other Pages on this &Host (HKLM)
O9 - Extra 'Tools' menuitem: AV Home (HKLM)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37876.3231018518

 

I don't see anything that would make a siren noise. However you need to disable the Service Connection. It is a part of Backweb, it is spyware. It is using your internet connection to send information on you, and it was installed by Compaq when the computer was new.
http://www.cexx.org/dlgli.htm

From this page:
http://www.answersthatwork.com/Tasklist_pages/tasklist_s.htm
Service Connection Center. This is a re-branded version of BACKWEB (see BACKWEB) which supposedly checks for updates for the setup and software of your Compaq PC whenever your are connected to the Internet.

Recommendation :
We have rarely seen this task to work properly, in most cases it simply does not work. There are also reports of it preventing ScanDisk and Defrag from completing. As per our comments on BACKWEB we recommend de-installing this task by de-installing "Service Connection Center" in Add/Remove Programs in the Control Panel. Alternatively, you can disable this task with Starter.
This Backweb could be the error, these type of programs don't always work as they should. Then there is the consideration of the age of the program. You have a Compaq installed with Win98, no doubt your Backweb server it out of date when it connects to the internet, yes it is connecting out. You wouldn't know this for sure as you do not have a firewall.
I would go into Control Panel, Add Remove Programs, and uninstall Service Connection, you will get the question "Are you sure you want to uninstall Backweb?" and answer yes. Then go get SpyBot Search & Destroy or HijackThis to remove what is left if it.

As for the sound, look in Control Panel\Sounds, and check the Windows Events Sounds. One of them, Critical Stop, Error, Question may have the siren coming from that. Compaq would do this to you.

Disable OEMRESET.EXE from starting, all it does it restore the startup items, or install drivers. All this is already done, no need to keep it going.

Disable TkBellExe, the Real Update thing. it is for their "subscription services" . Here is how:
To disable "tkbell.exe" in the new version (1) Start RealOne Player (2) Tools -> Preferences (3) Automatic services in the Categories pane (4) Uncheck all options and then OK

The above things I recommend you disable are absolutely unnecessary for your computer's health, and I would not doubt one of these is causing the conflict.

Disabling is easy to do. Go to Start\Run, type in Msconfig and press Enter. Click on Startup tab and uncheck items, except for TkBellExe. It must be done as above or it will appear again.

 

Thank you for all your patience. I do not know what in paticular did it, but the computer has been closing down smoothly---no flashes, no sirens, no exit code messages.

I had been closing all running programs and had been letting it sit for 10 - 15 minutes before closing down. I have quit doing that elaborate ritual and have had no problems. It is nice to have it act like a normal computer!

THANK YOU!

 

Thank you for all your help. I don't know what in particular did it, I tried everything that was suggested, but I am able to close down in a normal fashion --- no flashing messages, no sirens, no problems!

I apologize for this "thank you" taking so long but 1. I wanted to test it for a while under various circumstances, and 2. I write another message yesterday, but it never posted so I hit the wrong or I never hit "submit reply ".

The fact that there are people willig to help lame-brains like me is so great. Thanks!!!!