Windows 2000 Professional Errors

[ichunaw]

Hello guys,

Any help you can give to me will be greatly appreciated. My machine is doing weird things that I'll describe below.

1. Cut/Copy/Paste functionality is disabled in almost all applications. When I copy something and want to paste it, the Paste option is not enabled. It's like the data never made the clipboard.

2. I cannot drag and drop files across folders. I cannot even move the files around on my desktop. Even if I try copying a file and pasting it, it doesnt work.

3. Internet Explorer will not open a page in a new window. If there is a link which will open a page in a new window, it wont work.

4. Windows Media Player does not run. It says "Can't perform operation. Low Memory."

5. When I tried to fix something in the registry after looking up Microsoft's website, the registry window shows up for about 10-15 seconds and just dissappears. It is as if something is closing it down as soon as it is detected.

6. Any new application that requires Windows Installer does not install. I tried to install Norton and it said Windows Installer not found. When I tried to install Visual Basic 6.0, it said Cannot find ACME setup.

I have a 500 Mhz processor with 512 MB of RAM and I'm running Windows 2000 Professional. When i restart, the machine is fine for about 5-10 minutes and then all these problems reappear. I've just installed Windows 2000 about 3 weeks ago. Is this some virus that I can't catch? Any help that I can get will be awesome.

Thank you in advance.

 

[jrbarnett]

ichunaw

I have seen one other thread with similar problems within the XP forum and it turned out to be spyware, so I would do the following:

1) Run CWShredder, Spybot Search & Destroy and Ad-Aware over your PC, fixing everything it finds.
Remember to update Spybot and Ad-Aware after installing to pick up the latest definitions. Also update your antivirus scanner and run it over your PC.

2) If there is still a problem after this, run HijackThis and post the log file here.

Note: If you have a system checkpointing and restore application like Roxio GoBack installed, you must disable it before running the checkers.

John

 

[ichunaw]

I ran CWS Shredder. It did not find anything.
Spybot and AdAware found some stuff and I got rid of it.

I cannot run a virus check on my machine because I can't install anything because of the Windows Installer problem.

HijackThis's website is not up and running.

And I still have the same problem as before. :'( It is still not fixed.

 

[ichunaw]

Here is the Logfile that HijackThis created:

Logfile of HijackThis v1.97.7
Scan saved at 8:34:16 PM, on 2/22/2004
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
D:\WINNT\System32\smss.exe
D:\WINNT\system32\winlogon.exe
D:\WINNT\system32\services.exe
D:\WINNT\system32\lsass.exe
D:\WINNT\system32\spoolsv.exe
D:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
D:\WINNT\System32\svchost.exe
D:\WINNT\System32\iexploreu.exe
D:\WINNT\system32\regsvc.exe
D:\WINNT\system32\MSTask.exe
D:\WINNT\Explorer.EXE
D:\WINNT\loadqm.exe
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Program Files\Logitech\Video\LogiTray.exe
D:\Program Files\AIM\aim.exe
D:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
D:\WINNT\System32\LVComS.exe
D:\Program Files\Logitech\Video\LowLight.exe
D:\Program Files\Netscape\Netscape\Netscp.exe
D:\Program Files\MSN Messenger\msnmsgr.exe
D:\Documents and Settings\Imran Chunawala\Desktop\hijackthis1977\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.bensbargains.net/

N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://D%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src" (D:\Documents and Settings\Imran Chunawala\Application Data\Mozilla\Profiles\default\bz10wofo.slt\prefs.js)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar1.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINNT\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [LogitechVideoRepair] D:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] D:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [Internet Explorer Update] iexploreu.exe
O4 - HKLM\..\Run: [Windows Task Procedure] D:\WINNT\system32\rpcxpp.exe
O4 - HKLM\..\RunServices: [Internet Explorer Update] iexploreu.exe
O4 - HKCU\..\Run: [AIM] D:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [ares] "D:\Program Files\Ares\ares.exe" -h
O4 - Global Startup: Acrobat Assistant.lnk = D:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Cisco Systems VPN Client.lnk = D:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://D:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://D:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://D:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://D:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://D:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: AIM (HKLM)
O12 - Plugin for .spop: D:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) -

http://www.ipswitch.com/_installs/wsftp_le/setup.exe

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) -

http://software-dl.real.com/11f3b4f16b4770b9de18/netzip/RdxIE601.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -

http://active.macromedia.com/flash2/cabs/swflash.cab

O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) -

http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/1,5,0,4326/mcfscan.cab

 

[jrbarnett]

OK there's a few suspect entries here.

Go into task manager and see if you can terminate any instances of IEXPLOREU.EXE and RPCXPP.EXE, then run HijackThis and untick the following items:

O4 - HKLM\..\Run: [Internet Explorer Update] iexploreu.exe
O4 - HKLM\..\Run: [Windows Task Procedure] D:\WINNT\system32\rpcxpp.exe
O4 - HKLM\..\RunServices: [Internet Explorer Update] iexploreu.exe

This one, while not spyware, may be the cause for Setup not working properly, so you may want to remove it.
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) -

http://www.ipswitch.com/_installs/wsftp_le/setup.exe

After this, delete the IEXPLOREU.EXE and RPCXPP.EXE files from the disk and then from the recycle bin, then reboot and try and update your virus checker again.
It is also advisable to install Windows 2000 service pack 4 and run WindowsUpdate to get the latest security patches after doing this.

John

 

[kaniki]

Hey Ichunaw, have you fixed this problem yet.. I have exactly the same symtoms, they are drviing me up the walll!!!

 

[bcastner]

Open a notepad session and copy/paste the below as ie_fix.cmd

regsvr32 urlmon.dll
regsvr32 Shdocvw.dll
regsvr32 Msjava.dll
regsvr32 Actxprxy.dll
regsvr32 Oleaut32.dll
regsvr32 Mshtml.dll
regsvr32 Browseui.dll
regsvr32 Shell32.dll

Double click the saved file and answer any prompts. Ignore any error messages. Reboot and test again.

 

[vthiru]

when did u install ws_ftp LE, ichunaw
kaniki did u install ws_ftp LE aswell?
i installed that program yesterday and now im getting the same errors as u guys
the onli difference is that im running windows XP pro

 

[satrow]

http://download.nai.com/products/mcafee-avert/stinger.exe

McAfee AVERT Stinger will take care of some worms and virusses.

Andy.

 

[kaniki]

I did have wsftp on my last OS install. The errors didnt seem to coincide with this installation.. But I have just installed zonealarm firewall, and it has seemed to take care of this problem.. I also found ago31.exe in my system wich is some dodgy worm, so i got rid of it and it seems to work. Good luck.

 

[kaniki]

Thanks Satrow .. Good link