deleted something help 1

[dss147]

I have a program loaded on the hard drive. I go to the start program files and click on it and this appears.
" D:\WPWW21|wpworks.exe attempt to access invalid address"

I tryed even the folder itself no luck

I tryed to reinstall file off the disks that i have and same error.
system xp pro 512 ram

can anyone help please thanks dss147

 

[bcastner]

Reinstall the program as Administrator.

 

[dss147]

I am the admin

 

[bcastner]

Reinstall the program.
If this is the Word Perfect Suite, contact them as there are multiple patches that may need to be applied.

 

[dss147]

I tried to reinstall but when I do the same message appears

 

[dog29279]

I have this same problem trying to run an old version of quicken. I would really be interested in the solution.

 

[bcastner]

I am curious how old your copy of Quicken might be. The original poster, dss147 was using a version of WordPerfect issued three years prior to the beta releases of XP. From the "AbandonWare" site:

Novell PerfectWorks 2.1 - © 1995 Novell, Inc.
This is actually WordPerfect Works for Windows 2.1 Novell acquired from WP Corp. in 1994. The setup creates WPWW21 and WPDOCS subdirectories.

PerfectWorks is a word processor/spreadsheet/database/comm/drawing/paint "integrated" suite. The WP features table/spreadsheet insert, spell checker, QuickCorrect, 1-8 columns, etc. SS features in-cell editing, 112 functions, auto calc, Excel-like "+" cursor, ten 2D and 3D chart types, etc. DB features 7 field types, uses draw program to allow custom forms, browse records, etc. Comm program is a separate, full-featured terminal. Draw and Paint programs share most of the drawing tools, rulers, allow clip art import, etc. WP/SS/DB share find/replace, spell checker, thesaurus, Grammatik 6.0a, and ruler features. It also includes an electronic version of the User's Guide and Envoy reader.

PerfectWorks also includes 55 document templates, 78 WPG clipart images, 46 TrueType fonts, portions of Conversions Plus file translation library by DataViz Inc., parts of this suite are provided by Turning Point Software, and Novell provides PerfectWorks in 15 different languages.

This suite was released on CD-ROM. Total install size: 28.10MB"

It sounds like this suite is not happy with XP. And that might be your conclusion as well with an earlier version of Quicken.

 

[bcastner]

As a note, I have nothing against "Abandonware", and quite admire the site for keeping these oldie but goodies alive. No gaurantees, but there are over 1400 some programs for the past you can legally download for free. If for no other reason, the titles and descriptions are a nostalgic moment:

http://home.pmt.org/~drose/aw.html

 

[micker377]

dog29279:
How old is your Quicken? I'm using "Quicken 98". Properties states "Win 95 version release 7.0". I have newer versions, but they're bloated (I don't need investment advice). This version has been through five different computers!

 

[dog29279]

My version of quicken is early 1995. I think it was designed to run it with windows 95.

However -- I think the problem is actually linked to a new ver y challenging hijack program that is residing in dos memory. My research on the web shows that old programs that depend on DOS memory can generate this error if another program is residing in this memory taking up needed space.

The hijack program usually self executes a few minutes after I have booted the computer or if I engage internet explorer (thank god it has no affected firefox). The hijact program reroutes my home page to something called horseserve.net. I also generates a about 5 listings in my hijackthis.exe listing. Try googling "horseserve" - others have posted similiar problems. This hijack program appeared at the same time my quicken started generating this error.

Also - if I start quicken while booted in safe mode - it runs without any problems.

The usual fix of deleted hijackthis listings and deep scanning with adware do not remove this program. Unless someone comes up with a fix soon - a complete reformat and reload looks eminent.

 

[bcastner]

I Googled "horseserve" with one result, and it had nothing to do with malware.

 

[dog29279]

This is a copy of the hijack log (NAV and google suppressed) Note the last 7 lines. Yesterday it was horseserve.net. Today it is soft-trend.net.

Logfile of HijackThis v1.99.0
Scan saved at 5:31:28 PM, on 1/27/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\System32\COMSSTA.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Kevin V. Spriggs\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

http://soft-trend.net

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://soft-trend.net

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

http://soft-trend.net

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

http://soft-trend.net

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

http://soft-trend.net

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,First Home Page =

http://soft-trend.net

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

http://soft-trend.net

(End of Hijack log)
One suspicious file is mszx23.exe which appears in the hijack log just after logging on and before these other entries appear. So far it appears to be impossible to delete mszx23.exe. I am about to boot with the windows recovery disk and attempt to delete it with the command console. I will let yall know how it works.

regards, the dawg

 

[garebo]

Perhaps you could check your registry for references to
"WPWW21" and then "wpworks.exe" and then "works", thus deleting all registry references, and then try installing again.
I have found this had helped me out a lot of times and under a lot of different circumstances.
Only thing, and i have to say this even though you know, be careful about deleting references in registry. If not absolutely certain then leave the reference. And do a backup before you start.


Good advice + great people = tek-tips

 

[bcastner]

faq608-4650

 

[dog29279]

I am currently investingation an a posting at another forum -

http://www.techsupportforum.com/showthread.php?threadid=34937

- This guy has the same exact problem. I was unable to delete mszx23.exe. My system would not allow me to login as administrator with the recovery disk. I think this particular spyware or hijack program is very dangerous as none of the current virus scanners or ad removers can detect it or destroy it. RED ALERT ALL!

 

[bcastner]

Killbox can remove the file:

http://www.lavasoftsupport.com/index.php?showtopic=54511

This file also seems suspicous:
C:\WINDOWS\System32\COMSSTA.EXE

 

[dog29279]

COMSSTA.exe is driver program for my 3com wireless internet card. No changes appeared to have been made to this file from its original install.

Further investigations of other forums indicates that this problem is caused by a tough NEW dangerous program that some how embeds itself in the space that is normally used by DOS programs (thus my old version of quicken not being able to work). I wish I had a way to contact someone at Symantec and engage their support in investigating this NEW threat.

If no ones comes up with a cure process I plan to do a complete reinstal on my system.

 

[liriom]

try running the program in win98/95 compatibility mode

 

[dog29279]

Tried but it does not work. I can run the program in safe mode as temporary fix. I do have an angle on repair. I have found a posting on a lava-soft site forum that may lead to a repair. If it works I will post the link and results here. In the mean time all should be aware - Other forum reports that this virus includes key click scanners that grab your user IDS and pwds to transmitt to nefarious web sites!

 

[dog29279]

I believe I have discovered how the infection occured. Look at these realease note related to java scripting. I am posting the link below:

http://sunsolve.sun.com/search/document.do?assetkey=1-26-57708-1

Apparently the infection probably occured from a visit to a malicious web site.