Can't get connected to the Internet

[EJab]

WSCGetproviderPath failed, returning WSAEPROVIDERFAILEDINIT
is the messge I get over & over when I boot up or click ie.
I tried to reinstall Win 98 and get this message while installing: the application c:\wininsto.400\suwin.exe is trying to write to the master boot record of drive C. It also says: you may have to reinstall NOrton. I did just that. Now when I boot the system, I get messages that files from the security software are missing. I run quickfind and tried to delete all Symantec and Norton files and I still get the same messages

I tried everything I am told to do, now I am running out of options.

 

[erikhertzel]

Try download Spybot S&D and also the Winsock fix.

http://www.safer-networking.org/en/download

http://www.spychecker.com/program/winsockxpfix.html

 

[carrr]

You might find the winsock fix for 9x/ME more effective:

http://www.compu-docs.com/winsock9x.htm

Tired of waiting for an answer? Try asking better questions. See: faq222-2244

 

[carrr]

The messge you're getting is likely due to the fact that you've still got references to the AV in your startup configuration. You can start by using msconfig from the Start > Run option.

Tired of waiting for an answer? Try asking better questions. See: faq222-2244

 

[EJab]

Carr & Erikhertzel: Thanks! I was able using W2fix to get rid of this message: WscGetProviderPath failed, returning WSAEPROVIDERFAILEDUNIT

Now, I am back to where I was before. That is Internet explorer started to open a website (my home page) and it just stop. As if in a loop that it cannot get out of.

Also, in the process I had to eliminate Norton Security System. This left me with some hangover. I have to press on any key 3 times before I boot up. Some files from Norton are missing. It says window registry or system refer to this device(I assume Norton) file, but the device file no longer exist. I run a search to delete all Norton files. How come there is still some in the system.

I once re-install Norton and it gives me more trouble to boot up. I need to buy a newer version anyway.

I don’t know if w2fix.exe remove the spyware or not.

The uninstall process has not cleaned the registry entries properly and I don’t know how to fix it. And I don't think this is the reason my browser don't work.

Thanks again.

 

[carrr]

The winsock fix simply remedies damaged winsock entries.

How did you remove Norton? Using Add/Remove, or otherwise.

It osunds likel you need to search your startup configuration and your registry and remove any Norton references.

You could try to run a repair on IE:

http://support.earthlink.net/mu/1/psc/img/walkthroughs/windows_9x_nt/browsers/ie_6.0/8458.psc.html

But, you might consider running Hijack This! and posting a log back here for a lookover.


Tired of waiting for an answer? Try asking better questions. See: faq222-2244

 

[EJab]

Thank, I'll try running the IE repair when I get home later, but I am not sure how to run Hijack This! where to find it or is it in Winsdow 98 SE?

 

[carrr]

It's a free prog, you can download here:

http://www.tomcoyote.org/hjt/

It's fairly intuitive. Once you've run it, you can copy and paste a log into a post here.

Tired of waiting for an answer? Try asking better questions. See: faq222-2244

 

[EJab]

Logfile of HijackThis v1.99.0
Scan saved at 9:16:51 PM, on 3/9/2005
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\WINMODEM.101\wmexe.exe
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\VOYETRA\TBS MONTEGO\VTRAY.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\WINDOWS\SURFMONKEY\SMPROXY.EXE
C:\PROGRAM FILES\SCANSOFT\OMNIPAGESE\OPWARE32.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\COMMON FILES\ROXIO SHARED\PROJECT SELECTOR\PROJSELECTOR.EXE
C:\PROGRAM FILES\ROXIO\EASY CD CREATOR 6\DRAGTODISC\DRGTODSC.EXE
C:\PROGRAM FILES\ROXIO\EASY CD CREATOR 6\AUDIOCENTRAL\RXMON.EXE
C:\PROGRAM FILES\MICROSOFT HARDWARE\MOUSE\POINT32.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\MEDIA PASS\MEDIAPASS.EXE
C:\PROGRAM FILES\INTERNET OPTIMIZER\OPTIMIZE.EXE
C:\TEMP\SALM.EXE
C:\PROGRAM FILES\AUTOUPDATE\AUTOUPDATE.EXE
C:\WINDOWS\SYSTEM\SHDHTA3N.EXE
C:\PROGRAM FILES\QEBI\GKBQD.EXE
C:\PROGRAM FILES\BULLSEYE NETWORK\BIN\BARGAINS.EXE
C:\WINDOWS\SYSTEM\GAH95ON6.EXE
C:\WINDOWS\SYSTEM\SETBSE35.EXE
C:\PROGRAM FILES\EARTHLINK TOTALACCESS\TASKPANL.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\PROGRAM FILES\MEDIA PASS\MEDIAPASSK.EXE
C:\PROGRAM FILES\ROXIO\EASY CD CREATOR 6\AUDIOCENTRAL\PLAYLIST.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\INTERNET OPTIMIZER\ACTALERT.EXE
C:\PROGRAM FILES\CXTPLS\CXTPLS.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

http://www.surfbest.net/home

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://start.earthlink.net

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

http://www.surfbest.net/home

O2 - BHO: EarthLink Popup Blocker - {4B5F2E08-6F39-479a-B547-B2026E4C7EDF} - C:\Program Files\EarthLink TotalAccess\PnEL.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Antivirus\NavShExt.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {016235BE-59D4-4CEB-ADD5-E2378282A1D9} - C:\PROGRAM FILES\CXTPLS\CXTPLS.DLL
O2 - BHO: BHObj Class - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} - C:\WINDOWS\WSEM303.DLL
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\SYSTEM\MSBE.DLL
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Antivirus\NavShExt.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [VoyetraTray] C:\PROGRAM FILES\VOYETRA\TBS MONTEGO\VTRAY.EXE /s
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [ELNKProxy] C:\WINDOWS\surfmonkey\smproxy.exe
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [projselector] "C:\Program Files\Common Files\Roxio Shared\Project Selector\projselector.exe" -r
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [Media Pass] C:\Program Files\Media Pass\MediaPass.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [salm] c:\temp\salm.exe
O4 - HKLM\..\Run: [AutoUpdater] "c:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [msci] C:\PROGRAM FILES\MCAFEE.COM\SHARED\MCINFO.EXE /insfin
O4 - HKLM\..\Run: [NAV CfgWiz] C:\PROGRA~1\NORTON~2\CFGWIZ.EXE /R
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~2\NAVAPW32.EXE
O4 - HKLM\..\Run: [rmjmhsz] C:\WINDOWS\rmjmhsz.exe
O4 - HKLM\..\Run: [on5W36Q] SHDHTA3N.EXE
O4 - HKLM\..\Run: [Bpqaifu] C:\PROGRAM FILES\QEBI\GKBQD.EXE
O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe
O4 - HKLM\..\Run: [gah95on6] C:\WINDOWS\SYSTEM\gah95on6.exe
O4 - HKLM\..\RunServices: [winmodem] WINMODEM.101\wmexe.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - HKCU\..\Run: [Symantec Network Driver Update Warning] C:\PROGRA~1\SYMANTEC\LIVEUP~1\SNDWARN.EXE
O4 - HKCU\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe
O4 - HKCU\..\Run: [ZCu6RWcpj] SETBSE35.EXE
O4 - HKCU\..\Run: [E6TaskPanel] "C:\PROGRAM FILES\EARTHLINK TOTALACCESS\TASKPANL.EXE" -winstart
O4 - Startup: Lotus QuickStart.lnk = C:\lotus\wordpro\ltsstart.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: EPSON Background Monitor.lnk = C:\ESM2\Stms.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: Win32 Classes - file://C:\WINDOWS\Java\classes\win32ie4.cab
O16 - DPF: {1E2941E3-8E63-11D4-9D5A-00902742D6E0} (iNotes Class) -

https://r2webmailny.r02.epa.gov/iNotes.cab

O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} -

http://static.windupdates.com/cab/MusicUnlimited/ie/bridge-c8.cab

 

[EJab]

As instructed, above is the HijackThis log I just posted. While waiting for your instructions, I am seeing this symantec and Norton files I've been looking for to delete in DOS.

What will happen with the missing files. I don't want Norton in my system anymore. I want to buy another system.

When I boot up the computer, I get four missing files messages before I get to the desktop. They are the following:

C:\progra~1\symantec\symevnt.386
C:\" " \norton~1\SAVRTPEL.VXD
C:\ " " \ " " \SAVRT.VXD
C:\ " " \Norton~2\NAVAP.VXD

The message says the following: Files to run windows or applications is missing. Window Registry or system refers to this device file, but the device no longer exists. If you delete the file on purpose, try uninstalling the associated application

I could not run this repair on IE since I cannot get to the internet(is it downloadable?):

http://support.earthlink.net/mu/1/psc/img/walkthroughs/windows_9x_nt/browsers/ie_6.0/8458.psc.html

I've ie 6.0 on the other computer and it has a feature
that fix itself when you press Add/remove. Is it the same as that link?

Thanks again.

 

[EJab]

One more message: When I tried to go to the internet now, I get the following message: Total access cannot start properly while Internet explorer is running.

All I do is boot up the computer. I didn't click on ie before that. That means something automatically open ie upon startup.

Many regards

 

[erikhertzel]

Remove the following:

C:\PROGRAM FILES\INTERNET OPTIMIZER\OPTIMIZE.EXE
C:\TEMP\SALM.EXE
C:\WINDOWS\SYSTEM\SHDHTA3N.EXE
C:\PROGRAM FILES\QEBI\GKBQD.EXE
C:\PROGRAM FILES\BULLSEYE NETWORK\BIN\BARGAINS.EXE
C:\WINDOWS\SYSTEM\GAH95ON6.EXE
C:\WINDOWS\SYSTEM\SETBSE35.EXE
C:\PROGRAM FILES\INTERNET OPTIMIZER\ACTALERT.EXE
O2 - BHO: (no name) - {016235BE-59D4-4CEB-ADD5-E2378282A1D9} - C:\PROGRAM FILES\CXTPLS\CXTPLS.DLL
O2 - BHO: BHObj Class - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} - C:\WINDOWS\WSEM303.DLL
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\SYSTEM\MSBE.DLL
O4 - HKLM\..\Run: [ELNKProxy] C:\WINDOWS\surfmonkey\smproxy.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [salm] c:\temp\salm.exe
O4 - HKLM\..\Run: [AutoUpdater] "c:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [rmjmhsz] C:\WINDOWS\rmjmhsz.exe
O4 - HKLM\..\Run: [on5W36Q] SHDHTA3N.EXE
O4 - HKLM\..\Run: [Bpqaifu] C:\PROGRAM FILES\QEBI\GKBQD.EXE
O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe
O4 - HKLM\..\Run: [gah95on6] C:\WINDOWS\SYSTEM\gah95on6.exe
O4 - HKCU\..\Run: [ZCu6RWcpj] SETBSE35.EXE
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} -

http://static.windupdates.com/cab/MusicUnlimited/ie/bridge-c8.cab

then, download:

http://www.safer-networking.org/en/download

and if needed:

http://www.compu-docs.com/winsock9x.htm

 

[EJab]

HijackThis doesn't have an option to delete the C:\ files. I tried to delete them from my computer, but access was denied. One also says that Salm.exe is in use therefore cannot be deleted.

I am going to try to do that in safe mode or in MSDOS.

Regards.

 

[erikhertzel]

Let us know. Also, did you run Spybot?

Regards.

Erik

 

[carrr]

Ejab,

You can likely get rid of files like salm.exe while in safe mode, but some tend to exhibit a little more tenacity.
One way to yank them is to end any running processes (other than Explorer and Systray, on your OS) via Task Manager and then retry the delete, or to go into msconfig and remove suspect processes from your startup configuration - then restart and attempt deletion.

You should also keep a copy of Pocket Killbox handy. This is a great freeware utility that is quite effective against those "unable to delete" files. Find it here:

http://www.bleepingcomputer.com/files/killbox.php

You've been given a good read on what to yank.
You should find yourself clean free shortly.




Tired of waiting for an answer? Try asking better questions. See: faq222-2244

 

[EJab]

Wow, after 8 days I finally get to the internet.

After I deleted the files you've told me to get rid of using Hijackthis, I was able to get on the internet. There are still some hangover. The computer doesn't boot up by itself. The missing files messages still pop up. My earthlink homepage would not completely open, but I was able to get to other sites. Including Spybot which I just finish running.

Spybot found the following problems:
People on page
Alexa related
Bargain buddy
DSO Exploit
DyFuCA.internet optimizer
DyFuCA
Shop at home

All of them were automatically checked by spybot except for People on Page. So when I clicked on Fix the latter was not eliminated.

Should I run spybot again and check it myself so it can get eliminated?

At this point I restart the computer and I still get the following messages:

Files to run windows or applications is missing. Window Registry or system refers to this device file, but the device no longer exists. If you delete the file on purpose, try uninstalling the associated application.

C:\progra~1\symantec\symevnt.386
C:\" " \norton~1\SAVRTPEL.VXD
C:\ " " \ " " \SAVRT.VXD
C:\ " " \Norton~2\NAVAP.VXD

Also tell me if I still needed to run this:

http://www.compu-docs.com/winsock9x.htm

Regards

 

[erikhertzel]

Let Spybot run again at startup...

No, if you are on the net, don't worry about the winsock.

Glad your up at least.

 

[carrr]

You've already run the winsock fix successfully.

Now, you need to examine your startup configuration, starting with MS config and get the Norton references out of there.

Start > run > msconfig > startups tab > uncheck any norton references.

See how it boots now.

SpyBot is notorious for missing entries. You need to be running at leastp two or three progs in succession to ensure a good cleanup. I'd suggest Webroot SpySweeper and the Microsoft Antispyware Beta. Bazooka is a personal favorite, but be warned that it makes YOU do the cleanup (i.e. registry edits, manual file deletions). You try it based on your comfort/proficiency level.

Tired of waiting for an answer? Try asking better questions. See: faq222-2244

 

[EJab]

I couldn't find any Norton stuff in MS Config. I did find one of the file name you told me to delete using HijackThis. I unchecked it. That is SHDHTA3N.exe.

Still It can't boot up by itself.

I look at the following files as suspect in msconfig:

internat.exe
QuickTime Task, QTTASK.exe
Pointer32.exe
Load Power profile, Rundll32.exe pwrprof.dll

Let me know which of them I should uncheck


I also run Spybot a second time and find 3 items. I will run it a third time soon.