Updating to IE6

Tried to update my IE 5.5 to IE6 and I get this message:

A previous installation has pending work requiring a reboot. You need to start your computer complete that installation before running IE setup. Setup will now close.

Just some background: I did a Win 2000 SP4 upgrade recently, but cancelled during installation. I went in a second time at a later date and did the entire installation. I'm thinking this message may have something to do with the fact that I cancelled the first installation. I have tried rebooting and even tried installing SP4 again this morning, but I still get that message.

Any help would be appreciated.

 

From the MSKB:

Hope this helps!

 

Jeane--If PLandsdowne's excellent suggestion does not work, perhaps some help here
http://support.microsoft.com/default.aspx?scid=kb;en-us;221863&id=kb;en-us;221863

 

registry

Thank you both for your help. I am a little nervous going into the registry. If things go wrong is there a way to get my registry back running. I know people say to back it up -- but if I do, how would I go about putting it back on my machine?

Thanks again.

 

Jeane--You are correct to be cautious about modifying your Registry. For that reason you should BACKUP your Registry (or at least the parts you plan to change) before making changes.
I believe this is fairly well explained here, but if not post back
http://support.microsoft.com/default.aspx?scid=kb;EN-US;322755
(These instructions are specific to Win2000)
P.S. If it makes you feel any safer, your PC is probably automatically making a back up of your Registry every day you boot. However, I am not familiar with Win2000, so do not know if the way you restore the Registry is System Restore or use SCANREG /RESTORE from an MS-DOS Prompt. Let's not worry about that now.

 

article

The article confuses me. It talks about "domain controller" -- don't know what that is. Then it has a link to explain how to backup and restore but when you get down to the bottom of the page it states this is for Windows Server -- not professional. Also when saving a registry file it says to go to "save key" on the main menu -- I don't have that. I do have "save tree" under "registry." I appreciate all your help, but I guess I'm not computer savvy enough to trust what I am doing. I will print this article and try to ask others for help also.

You guys are great here -- more help here than anywhere on the net!

 

Jeane--I am looking at the reference I provided. Under "How to Export Registry Keys" I cannot find mention of "domain controller ". In fact I cannot find that reference anywhere in the MS article.
I would not worry about the reference to 2000 Server if what is suggested works.

 

Deleted PendingFile...

I went into the registry and deleted the PendingFileRenameOperations. All was o.k., but when I restarted my computer it was back, but the data at the end of the file had a different number. When deleting it again and restarting it comes back with a different number.

This is what I deleted:
Name: PendingFileRenameOperations
Type: REG_MULTI_SZ
Data: |??|DOCUME~1\ADMINI~1\LOCALS~1\Temp\~703026.tmp

When I did a search for *tmp files this file came up with the ~703026 along with others that were there (different ~#) before I restarted. When I clicked on properties the files show as IE temp files.

So in other words, I can't seem to get rid of the PendingFileRenameOperations file, but yet it seems I can't update IE without getting rid of this.

I also did as the article stated and deleted temp internet files, temp files, etc. Does anyone have any other suggestions?

Thanks!

 

Open C:\Documents and Settings\Administrator\Local Settings\Temp, select all and delete. Clear the registry key again and reboot. You will need to show hidden files and folders. If you get a message about unable to delete, log on to another account with administrative rights and delete them.

 

deleting files

Noahdfear,
Before I do this, I just wanted to ask one more thing. I did a roll back to 2 days ago (before I tried the IE update). Now I have a different PendingFileRenameOperations file in the registry -- the one probably preventing me from doing the IE update -- it is:

Data: \??\Crogram files\common files\wintools\update\WinToolsB.dll !
then it repeats after the !

I have that WinTools for IE in my add/remove programs -- been wondering what it is. I here it is a trojan or something, but then again there is a legitimate WinTools -- not sure what I have.

My question: Where you tell me to go to delete those temp files, there are quite a few files (and folders) and one of them is this WinToolsB.dll. Is is o.k. to delete dll files?

Thanks again

 

Just wanted to mention:

I do not know where that smiley face came from -- I did not type it in. Weird.

 

OH BOY! If you have Ad-aware, update it and run, then reboot. If you don't, download it from my signature, install and immediately update. Configure it for a custom full scan and run. Delete all it finds. Then, download HijackThis from the CWShredder link in my signature. Place it in a permanent folder(I create a new folder in C:\ named HJT). Open and hit scan, then save log. Once it is saved it will open in notepad. Select all from the edit button, copy and paste the results here. Don't fix anything with it yet!

EDIT- Guess I should have mentioned, Wintools is a nasty!

 

Jeane-- I only answer the important questions. The smiley face is created by putting a : next to a P. So when you wrote C followed by : followed by Program you got . (You should have written C:\Program. )
However, to less important matters. Yes, WinTools is a real baddie. And using System Restore is not going to help. In fact it is going to hurt. After everything else you to get rid of WinTools you should delete your System Restore files. Otherwise whenever you use System Restore in the future, you will just be reinstalling WinTools.
Some ideas for getting rid of WinTools
http://www.pchell.com/support/wintools.shtml
http://www.kephyr.com/spywarescanner/library/bubba.wintools/index.phtml
http://www.geocities.com/flatfilsoc/remove_wintool.html
Good luck.

 

HijackThis log

Here is my HijackThis log:

Logfile of HijackThis v1.97.7
Scan saved at 9:52:10 PM, on 6/5/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP2 (5.00.2920.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
C:\WINNT\system32\LEXPPS.EXE
C:\WINNT\System32\CTsvcCDA.EXE
C:\WINNT\System32\svchost.exe
C:\Program Files\Roxio\GoBack\GBPoll.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\MsPMSPSv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\SymTray.exe
C:\WINNT\system32\devldr32.exe
C:\PROGRA~1\NORTON~1\NORTON~1\navapw32.exe
C:\Program Files\Common files\WinTools\WToolsA.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
C:\Program Files\Common files\WinTools\WSup.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Common files\WinTools\WToolsS.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch.com/ie.aspx?tb_id=50026
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.earthlink.net/partner/more/msie/button/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.newsnet5.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.earthlink.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie/button/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://server224.smartbotpro.net/7search/?hklm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50026
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50026
R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
O2 - BHO: EarthLink Popup Blocker - {4B5F2E08-6F39-479a-B547-B2026E4C7EDF} - C:\Program Files\EarthLink TotalAccess\PnEL.dll
O2 - BHO: (no name) - {63B78BC1-A711-4D46-AD2F-C581AC420D41} - C:\PROGRA~1\COMMON~1\WinTools\btiein.dll
O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
O2 - BHO: (no name) - {D6DFF6D8-B94B-4720-B730-1C38C7065C3B} - C:\PROGRA~1\COMMON~1\BTLINK\btlink.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Pop-Up Blocker - {D7F30B62-8269-41AF-9539-B2697FA7D77E} - C:\Program Files\EarthLink TotalAccess\PnEL.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [PrinTray] C:\WINNT\System32\spool\DRIVERS\W32X86\2\printray.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [SymTray - Norton SystemWorks] C:\Program Files\Common Files\Symantec Shared\SymTray.exe SetReg
O4 - HKLM\..\Run: [WinTools] C:\Program Files\Common files\WinTools\WToolsA.exe
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [DIAGENT] C:\Program Files\Creative\SBLive2k\Creative Diagnostics 2.0\DIAGENT.EXE startup
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive2k\Program\AHQInit.exe
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart
O4 - HKLM\..\RunOnce: [SymTray - Norton SystemWorks] C:\Program Files\Common Files\Symantec Shared\Symtrdr.exe
O4 - Global Startup: hpoddt01.exe.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - Global Startup: officejet 6100.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0C3F7D74-ADA5-4976-8908-A8189590DAFA} (3DGreetings.com Player 2.0) - http://expressit.broderbund.com/Plugin/3DGreetings/vroom.CAB
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {26E8361F-BCE7-4F75-A347-98C88B418322} - http://dst.trafficsyndicate.com/Dnl/T_50026/QDow.cab
O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/productupdates/content/opuc.cab
O16 - DPF: {5B27C20D-FFB6-4054-BA78-DE4A059BC75A} (Microsoft Office Template Downloader) - http://office.microsoft.com/ca/TemplateGallery/msotd.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37872.2985185185
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

 

Scan again with HJT, place a check next to the following entries, close ALL other windows and click fix. If the newsnet5 entry is the homepage you set, don't check it.


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch.com/ie.aspx?tb_id=50026
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.earthlink.net/partner/mo...ton/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.newsnet5.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.earthlink.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/mo...ton/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://server224.smartbotpro.net/7search/?hklm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50026
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50026
R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
O2 - BHO: (no name) - {63B78BC1-A711-4D46-AD2F-C581AC420D41} - C:\PROGRA~1\COMMON~1\WinTools\btiein.dll
O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
O2 - BHO: (no name) - {D6DFF6D8-B94B-4720-B730-1C38C7065C3B} - C:\PROGRA~1\COMMON~1\BTLINK\btlink.dll
O4 - HKLM\..\Run: [WinTools] C:\Program Files\Common files\WinTools\WToolsA.exe
O16 - DPF: {26E8361F-BCE7-4F75-A347-98C88B418322} - http://dst.trafficsyndicate.com/Dnl/T_50026/QDow.cab



Reboot to safe mode.


Open task manager and verify that none of the following are running. End process on any that are.


WToolsA.exe
WSup.exe
WToolsS.exe


Navigate to C:\Program Files\Common Files and delete the following folders.

WinTools
BTLINK

Run disk cleanup, making sure to include emptying Temps, TIFs and recycle bin.

Reboot to windows and post a new HJT log, along with any comments.

*As noted by Jim, none of your system backups will be any good, and should be deleted.

 

Thanks for the help.

2 more questions: Earthlink is my ISP -- should I still check these? Also, when you say delete system backup do you mean registry backup that I did when I was in regedit?

 

When you installed the ISP's software, it hijacked your IE start page and search page. If you want to use them, it's fine to exclude them from the fix. I just hate hijacks, regardless of who did it, and usually just include them in the fix. Fixing them will reset the MS defaults, which is MSN search and MSN homepage, either of which you can customise easily enough.

You referred to 'rolling back to two days ago'. Was that with a registry backup? Jim mentioned system restore, but Win2000 doesn't have SR, does it? Well, doesn't matter. Any registry backups will have the entries we are removing now, so are no good. If you backed up the system files, they will most likely have the WinTools and BTLINK references also, and you don't want them either.

 

Jeane--Since I run Win98, I just assumed that all Windows versions after that had System Restore. Well, it seems Win2000 does not, as noted by noahdfear.
However, the principle remains the same, you want to get rid of any recent system backups (like Registry backups or perhaps rbxxx.cab files, where xxx stands for numbers) since they will only restore the hijacking malware if they are used).

 

System Restore started with WinME then on to WinXP...for those that care...

 

The "rolling back" was in reference to my using "Go Back" that came with my Norton Systemworks.

In Add/Remove programs, I have WinTools Easy Installer, WinTools for IE, and WinTools for IE v.2 When Should I Remove them? Also, before I start, just wanted to make sure one last time that this is not the legitimate Win Tools that is supposedly out there -- I'm confused, is there a legitimate one?

Pleas excuse the questions, as this is new to me.

Jeane