Canuck

Hello, I would be grateful for any help or advice on what I can do to save some important information I stupidly forgot to backup on my PC. After three days of struggle I am at the point of slowly copying what I can via DOS to floppy disks (thus weeks of work) and reformatting the disk (cry, cry). I feel the disk and information is saveable I just do not know how. Excuse any slips in writing here as I am on a friend's French keyboard. I have also included a Hijack log I made just before the problem occured.

Here goes:
Current behavior of machine (Win98 SE fully patched, FAT32): It goes though Normal and Safe Mode bootup. At the point of getting to the desktop (that is I can see the desktop background but nothing else such as icons) I get a message such as Spool32 fault. The computer freezes and I have to turn it off.

How it started: Basically it started with a minor (it seemed) problem with Zone Alarm (paid version) and some error message with the software not being able to find a certain file beginning with vs...

Internet Explorer would crash as soon as I directed it to a web site, but it would open a page stored on my hard drive. In fact every program that tried to access the Internet would crash (Outlook express, Adobe Acrobat). The error messages gave the source as unknown but mentioned RPCSS.EXE. Or I think Rpcss.exe error messages would also appear after the various software would crash.

Finally after fiddling around I removed Zone Alarm. The fun really started. The same error was occuring. Using regedit I removed references to Zone Alarm following the instructions for what seemed like a similar problem I found on the Internet.

I remember also removed Rpcss.exe and later Mdm.exe (after backing up) at some point. Thinking it was a problem with Java I removed Java. I removed

Still no luck. At this time I was still able to boot up and get into windows and use other programs. I reloaded Internet Explorer.No joy.

At this point I saved a Hijack this log and my bootlog and information from a Microsoft System information tool (I forget the english name), about the only smart thing I did

Then one of several things I did after (including another edit of the registry) must have led to the current situation described above.

What I have done: During the past three days I have done a lot so its all a muddle so the order of someof the events might be confused. I have tried booting with the start up and emergency disk: I have tried numerous variations of Yesses and Nos to Command Prompt from Dos start up.

In DOS I have used Scanreg and scanreg /fix. No joy. A partition error was found and fixed. I have also replaced the registry with some of the stored backups on the harddrive. I tried replacing a few files i the windows and systems folders from my Win98 CD. I have tried using previous win.ini and systems.ini files.

When I rename the Spool32.exe file; the computer boots to the desktop background screen with a similar error or fault message for Mprexe.exe and freezes.

When I rename Mprexe.exe, the same occurs this time with a fault in Msgsrv32.exe. Interestingly the computer does not seem to freeze. I can click on the error/fault message and it disappears. But all I get is a desktop void of any icons or bars but with my background colour. I end up having to shut doing as there is nothing to click.

Now; I have reverted back to the Spool32 and other files that I manipulated from DOS. In desperation I tried loading a copy of Win XP from DOS but it says it needs Windows to run...hmmmmm.

As you can see, while I am not a tech guy I seem to think I know my way around Win 98 (I am a freelance business reporter who also writes a weekly column on technology (not just computers but also the social aspects). As you can see I have followed none of my advice on backing up, something I will be telling my readers). What I have learned so far. Hubris kills. I discovered DOS commands.

Hope someone can help...and does not mind this detailed message. Cheers, Canuck.

HJ Log

Logfile of HijackThis v1.98.2
Scan saved at 18:51:02, on 19/04/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
c:\windows\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\TABLET.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\DSLAGENT.EXE
C:\WINDOWS\DITASK.EXE
C:\WINDOWS\SYSTEM\DLA\TFSWCTRL.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\ATIPTAXX.EXE
C:\WINDOWS\TPPALDR.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\CD-WRITER PLUS\DIRECTCD\DIRECTCD.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\EXPLORER.EXE
C:\HJT\HIJACKTHIS19802.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir...r=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir...ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir...ie&ar=iesearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/keyword/%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
F1 - win.ini: run=hpfsched
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_5_7_0.DLL
O2 - BHO: BrowserHelper Class - {EBCDDA60-2A68-11D3-8A43-0060083CFB9C} - C:\WINDOWS\SYSTEM\NZDD.DLL (disabled by BHODemon)
O2 - BHO: (no name) - {ACB3E0B7-7D0C-40B7-99B3-3EEACDF86BFB} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_5_7_0.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [DiTask] c:\windows\ditask.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system\dla\tfswctrl.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb04.exe
O4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exe
O4 - HKLM\..\Run: [ALiUSBfix] C:\WINDOWS\SYSTEM\GREENMK.exe
O4 - HKLM\..\Run: [OWCCardbusTray] ocbtray.exe
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\TPPALDR.EXE
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Adaptec DirectCD] C:\PROGRA~1\CD-WRI~1\DIRECTCD\DIRECTCD.EXE
O4 - HKLM\..\RunServices: [KB891711] c:\windows\SYSTEM\KB891711\KB891711.EXE
O4 - HKLM\..\RunServices: [Tablet] C:\WINDOWS\SYSTEM\Tablet.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Open Frame in &New Window - C:\WINDOWS\WEB\frm2new.htm
O8 - Extra context menu item: &Highlight - C:\WINDOWS\WEB\highlight.htm
O8 - Extra context menu item: &Web Search - C:\WINDOWS\WEB\selsearch.htm
O8 - Extra context menu item: &Links List - C:\WINDOWS\WEB\urllist.htm
O8 - Extra context menu item: Zoom &In - C:\WINDOWS\WEB\zoomin.htm
O8 - Extra context menu item: Zoom O&ut - C:\WINDOWS\WEB\zoomout.htm
O8 - Extra context menu item: I&mages List - C:\WINDOWS\Web\imglist.htm
O8 - Extra context menu item: &Document Tree - C:\WINDOWS\web\tree.htm
O8 - Extra context menu item: View Partial So&urce - C:\WINDOWS\web\source.htm
O8 - Extra context menu item: Grab &Selected Text... - res://C:\PROGRAM FILES\COGITUM CO-CITER\COGITUMHELPERS.DLL/ctGrab.htm
O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsearch.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsimilar.html
O8 - Extra context menu item: Backward Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmtrans.html
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {438AFBA1-B0CB-11d2-9214-00104B3BCE5F} - C:\WINDOWS\web\tree.htm
O9 - Extra 'Tools' menuitem: &Document Tree - {438AFBA1-B0CB-11d2-9214-00104B3BCE5F} - C:\WINDOWS\web\tree.htm
O9 - Extra button: Co-Citer - {CDE56277-42BE-11d4-B79C-00C0F04903DC} - C:\PROGRAM FILES\COGITUM CO-CITER\Co-Citer.exe
O9 - Extra 'Tools' menuitem: Cogitum &Co-Citer - {CDE56277-42BE-11d4-B79C-00C0F04903DC} - C:\PROGRAM FILES\COGITUM CO-CITER\Co-Citer.exe
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\PROGRAM FILES\HELLO\PICASACAPTURE.DLL
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\PROGRAM FILES\HELLO\PICASACAPTURE.DLL
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O15 - Trusted Zone: hotmail.msn.com
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/sj/en/check/qdiagh.cab?326
O16 - DPF: {9B17FE0E-51F2-4692-8B32-8EFB805FC0E7} (HPObjectInstaller Class) - http://h30155.www3.hp.com/ediags/gs/...dsolutions.cab
O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://www.truedoc.com/activex/tdserver.cab
O16 - DPF: {99B6E512-3893-4155-9964-8EB8E06099CB} (WebSpyWareKiller Class) - http://download.zonelabs.com/bin/pro...tor/WebSWK.cab
O16 - DPF: {EFAEF0E4-F044-4D57-9900-1C3FF18524C9} (AV Class) - http://www.pcpitstop.com/antivirus/PitPav.cab
O16 - DPF: fdjeux - https://www.fdjeux.net/classes/fdjeux.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yaho...st_current.cab
O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} (DD_v4.DDv4) - http://www.drivershq.com/DD_v4.CAB
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15009/CTSUEng.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15010/CTPID.cab
O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C} (ICSScannerLight Class) - http://download.zonelabs.com/bin/free/cm/ICSCM.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/pro...tor/WebAAS.cab

Geekgirl

Hello and Welcome to TSF

Lets try this just for fun...I have my reason

Click Start>Run type in msconfig
Click on the Startup tab and find c:\windows\SYSTEM\KB891711\KB891711.EXE, take the tick out of the box so it does not start at boot.
Click Apply>Ok and Reboot

Let me know if it has helped

Canuck

Thanks for the reply. I suspected that as well. However I am unable to get to my desktop, to start, run or config. Only MSDOS commands are available as detailed above. Is there a way to do this from there? Or should I just disable the exe by changing its name in MSDOS?

Canuck

As a followup I disabled c:\windows\SYSTEM\KB891711\KB891711.EXE through MSDOS along with the dll file in the folder by changing the names of the files. No luck. Same problem. My problem seems unfixable?

Terrister

At the dos prompt, you can type cd windows\SYSTEM\KB891711. Now type rename KB891711.EXE KB891711.old.

This should keep this from running when you restart windows.

Geekgirl

It would be easier to take your hard drive to a friends place and hook it up as a slave and pull your info off like that. Im sure you will have access to your data.

You may be able to repair with a 98 disc.

Canuck

I did try reloading Win98 with my Win98 disk but because my computer's drive is compressed it refused to do this at the very end of the process.

Hooking my computer up as a slave to my friend's computer to get the information seems like the solution. I had not thought of it. Is this difficult? Is there a site with instructions on how to do this?

Thanks Geekgirl, you have given me hope!

Geekgirl

Its not hard at all. You take out your hard drive, change the little jumper on the end to slave, connect to friends computer as slave on primary controller. Boot the machine, go into My Computer and your hard drive should be the D:\ drive. You can right click and chose explore and start copying your data.
Heres some pics on this link to show how to set the jumper. Not all the information pertains to you so dont get scared if you read through it. You dont need to place your drive in the case you can leave it hang out over the edge just for the purpose of gathering your info.
http://www.helpwithpcs.com/upgrading...hard-drive.htm

http://www.helpwithpcs.com/upgrading...ve-fig-1-2.jpg

http://www.helpwithpcs.com/upgrading.../ide-cable.jpg

Canuck

Thank you Geekgirl! I will report back on the attempt after convincing my girlfriend I am not a computer dolt after all. She has backed up all her files etc just in case!

Canuck

Problem solved. I hooked up the two harddrives. Was pleased to see my drive with contents. I recovered all my data. Reformatted the drive and reloaded my software. Everything works better now....Thanks for all the help and advice.

Incidently I think your first hunch was right GeekGirl. KB891711.EXE, the Microsoft Update, seems to have caused all sorts of problems for Win 98 systems as a search on Google shows. I just panicked and made the problem worse instead of just disabling it. I should have gone to MSconfig first and isolated the problem.

Geekgirl

I'm glad you got it resolved.

Stop back if you have any more problems