Help..System File Checker, etc

nureyev · #1 March 11th, 2004, 03:18 PM

I really need some help...I've been having problems, can't download from websites or even get the win updates. I ran the diagnostic programs under system tools, and System File Checker found this to be possibly corrupted:

setupx.dll from C:\WINDOWS\SYSTEM

However I DON'T have a win 98 install disk, so is there any other way to fix this file??

FWIW here is my post from the Hardware forum, any help with this would be GREATLY appreciated: ( I did try to clear all cookies/temp internet file and change security setting...no results)

<<Hi, first time poster and beginner here. A friend gave me her old computer, it's an ibm aptiva with only 64 MB ram but it runs well. The only problem is I can't download anything from any websites. It begins the download process, but then does not progress to the next step- it will not bring up the dialog box to choose "save" or "open". It has W98 (ver2), and we are on MSN 9 dial up. I CAN download from CD's tho. A tech at MSN said it may be a "file association problem".>>

Thanks!
Linda

mike · #2 March 12th, 2004, 02:58 AM

Hi,

For the "setupx.dll from C:\WINDOWS\SYSTEM" ,
just click on "Update verification table" ( I think that is the option available,,, it`s been a long time )

For the connection problem,
download HijackThis from:
http://mjc1.com/mirror/hjt/

Please download HijackThis to a new folder, not a TEMP folder.

Unzip, and open up the program.
Click on the "Scan" button.
It will change into a "Save Log" button.
Click "Save Log" and save to the new folder you downloaded to.

Do not make any changes to the list.

Copy and paste the log to this thread, please.

Cheers

EDIT:

Open Windows Explorer and navigate to C:\windows folder.
Open C:\windows folder and scroll down.
Do you see "Options" folder.
If you do , look inside and you may have a "Cabs" folder.

That is windows cdrom , copied to folder on HD.

Pancake · #3 March 12th, 2004, 03:07 AM

You should be able to get a friend to put it on a floppy for you if you need it.. http://www.dll-files.com/dllindex/dl...s.shtml?setupx

nureyev · #4 March 12th, 2004, 03:47 AM

I tried to verify the table on SFC for that dll, but it still picks it up as corrupt. I'll look into getting it saved onto a floppy, thanks...

Here is the scan log from hijack this:

Logfile of HijackThis v1.97.7
Scan saved at 10:45:36 PM, on 3/11/2004
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SYMTRAY.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\MSN\MSNIA\MSNIASVC.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAM FILES\INTERNET CALL MANAGER\ICM.EXE
C:\PROGRAM FILES\MSN\MSNCOREFILES\MSN.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\HOTBAR\BIN\4.2.11.0\HBSRV.EXE
C:\PROGRAM FILES\POWERDESK\PDEXPLO.EXE
C:\WINDOWS\TEMP\~~PDTEMP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.nkvd.us/s.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.nkvd.us/s.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.nkvd.us/s.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nkvd.us/1507/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.nkvd.us/s.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.nkvd.us/s.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.nkvd.us/s.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.nkvd.us/s.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nkvd.us/1507/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.netscape.com/home/winsearch200.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.nkvd.us/s.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.nkvd.us/s.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.nkvd.us/s.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.nkvd.us/s.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://keyword.netscape.com/keyword/%s
R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://www.nkvd.us/s.htm
R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://www.nkvd.us/s.htm
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://vermontel.net"); (C:\Program Files\Netscape\Users\joyceo\prefs.js)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O2 - BHO: Hotbar - {B195B3B3-8A05-11D3-97A4-0004ACA6948E} - C:\PROGRAM FILES\HOTBAR\BIN\4.2.11.0\HBHOSTIE.DLL
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Hotbar - {B195B3B3-8A05-11D3-97A4-0004ACA6948E} - C:\PROGRAM FILES\HOTBAR\BIN\4.2.11.0\HBHOSTIE.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\RunServices: [SymTray - Norton SystemWorks] C:\Program Files\Common Files\Symantec Shared\SymTray.exe "Norton SystemWorks"
O4 - HKLM\..\RunServices: [MSNIA] C:\PROGRA~1\MSN\MSNIA\MSNIASVC.EXE
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Real.com (HKLM)
O12 - Plugin for .qt: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O12 - Plugin for .mov: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O12 - Plugin for .aiff: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O12 - Plugin for .exe: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O13 - DefaultPrefix: http://www.nkvd.us/1507/
O13 - WWW Prefix: http://www.nkvd.us/1507/
O13 - Home Prefix: http://www.nkvd.us/1507/
O13 - Mosaic Prefix: http://www.nkvd.us/1507/
O16 - DPF: {69FD62B1-0216-4C31-8D55-840ED86B7C8F} (HbInstObj Class) - http://installs.hotbar.com/installs/...ams/hotbar.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...045.9136458333
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = vermontel.net
O17 - HKLM\System\CCS\Services\VxD\MSTCP: SearchList = vermontel.net
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 63.167.45.18,63.167.45.26

mike · #5 March 12th, 2004, 04:24 AM

Please download CWShredder from:
www.zerosrealm.com/downloads/CWShredder.zip

Unzip, Open CWShredder and click on the Fix button to find and fix any problems.

How to stop CWS infection...read the information when you click "Next" at the end of running CWShredder.

Reboot Computer.

Cheers.

mike · #6 March 12th, 2004, 04:46 AM

Hi,

Remove HotBar through Add/Remove Programs in the Control Panel.

I`ll include everything in case you cannot download CWShredder.

If you do download CWShredder , run it first ,...and dont worry if some entries are not present.

You will still need to run CWShredder later, though.
As well as Ad-aware and Spybot.

Close ALL browser Windows and Windows Explorer windows, only have HijackThis running.

In HiJackThis, Check the boxes beside the below entries, then click on "Fix checked" .

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.nkvd.us/s.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.nkvd.us/s.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.nkvd.us/s.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nkvd.us/1507/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.nkvd.us/s.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.nkvd.us/s.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.nkvd.us/s.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.nkvd.us/s.htm

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nkvd.us/1507/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.nkvd.us/s.htm

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.nkvd.us/s.htm

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.nkvd.us/s.htm

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.nkvd.us/s.htm

R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://www.nkvd.us/s.htm

R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://www.nkvd.us/s.htm

O2 - BHO: Hotbar - {B195B3B3-8A05-11D3-97A4-0004ACA6948E} - C:\PROGRAM FILES\HOTBAR\BIN\4.2.11.0\HBHOSTIE.DLL

O3 - Toolbar: &Hotbar - {B195B3B3-8A05-11D3-97A4-0004ACA6948E} - C:\PROGRAM FILES\HOTBAR\BIN\4.2.11.0\HBHOSTIE.DLL

O13 - DefaultPrefix: http://www.nkvd.us/1507/

O13 - WWW Prefix: http://www.nkvd.us/1507/

O13 - Home Prefix: http://www.nkvd.us/1507/

O13 - Mosaic Prefix: http://www.nkvd.us/1507/

O16 - DPF: {69FD62B1-0216-4C31-8D55-840ED86B7C8F} (HbInstObj Class) - http://installs.hotbar.com/installs...rams/hotbar.cab

Close HJT.
Reboot Computer

Post back a new HJT log after reboot, please.

Cheers

PS: Did you find a C:\windows\options folder

.

nureyev · #7 March 12th, 2004, 06:11 AM

Quote:

Originally Posted by mike

Hi,

Remove HotBar through Add/Remove Programs in the Control Panel.>>

Will do next!

<<PS: Did you find a C:\windows\options folder

.

>>

I was able to download a copy of that dll file to a folder and restore it thru the FSC.

So that's fixed. Ran FSC again and it's clean....

I find I can download some things by right clicking and choosing "download later as" to save to a folder, then go from there.
I was able to down load CW Shredder, it did remove things, as well as ad aware (81 things removed!) Here is the new log:

Logfile of HijackThis v1.97.7
Scan saved at 1:06:06 AM, on 3/12/2004
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SYMTRAY.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\MSN\MSNCOREFILES\MSN.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\MSN\MSNIA\MSNIASVC.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAM FILES\POWERDESK\PDEXPLO.EXE
C:\WINDOWS\TEMP\~~PDTEMP\HIJACKTHIS.EXE

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.netscape.com/home/winsearch200.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://keyword.netscape.com/keyword/%s
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://vermontel.net"); (C:\Program Files\Netscape\Users\joyceo\prefs.js)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\RunServices: [SymTray - Norton SystemWorks] C:\Program Files\Common Files\Symantec Shared\SymTray.exe "Norton SystemWorks"
O4 - HKLM\..\RunServices: [MSNIA] C:\PROGRA~1\MSN\MSNIA\MSNIASVC.EXE
O9 - Extra button: Real.com (HKLM)
O12 - Plugin for .qt: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O12 - Plugin for .mov: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O12 - Plugin for .aiff: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O12 - Plugin for .exe: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...045.9136458333
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = vermontel.net
O17 - HKLM\System\CCS\Services\VxD\MSTCP: SearchList = vermontel.net
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 63.167.45.18,63.167.45.26

Does this look OK?

Thank you Mike and everyone else for all the help!

Linda

mike · #8 March 12th, 2004, 06:23 AM

Hi ,

PS: Did you find a C:\windows\options folder

the log looks real good.

I was going to suggest Adaware, but you beat me to the punch.

Keep Adaware uptodate and scan regularly...weekly.
So some internet downloads have improved. ? ??

I don`t run IE , so forget the little probs with IE.

Goto Control Panel--Add/Remove Programs----"IE6
and internet Tools."

Double-click on "IE6 and internet Tools" and choose "Repair Internet Explorer".

Cheers.

nureyev · #9 March 12th, 2004, 03:31 PM

Quote:

Originally Posted by mike

Hi ,

PS: Did you find a C:\windows\options folder

the log looks real good.

I was going to suggest Adaware, but you beat me to the punch.

Keep Adaware uptodate and scan regularly...weekly.
So some internet downloads have improved. ? ??

I don`t run IE , so forget the little probs with IE.

Goto Control Panel--Add/Remove Programs----"IE6
and internet Tools."

Double-click on "IE6 and internet Tools" and choose "Repair Internet Explorer".

Cheers.

Mike,

I repaired IE, dosn't seem to have had any effect on downloading. I DID find a win/options folder with "cabs". What was I supposed to do with that again?

I can download some things but not others. I can never download by just left clicking on the "download now" links.....when I do that, it does begin the download (you see it loading stuff in the bar right above the start button) but I NEVER get a dialog box to choose save or open. On some downloads I can RIGHT click on the "download now" link and choose "download later as ", and I can put the item in a folder. In these cases I get a blue dialog box, sort of, from my "download manager" thing from MSN 9.

Linda

**Miz** · #10 March 12th, 2004, 04:34 PM

The Options/Cabs folder Mike referred to contains the files which are on the Windows CD that are accessed when SFC is extracting files to replace.

Since you don't have a Windows disk, that folder is quite important. If you have any way to make a CD, I suggest you burn that folder to a CD.

There is a registry edit that will make Windows look to that folder instead of asking for the CD (that you don't have).

Usual warning: Editing the registry incorrectly can render your computer unbootable so proceed with caution. That said, don't be intimidated. Follow the instructions below carefully and it will work. Just don't get in a hurry and you might want to back up the entry you're going to change so you can restore it if you want.

The steps:
1. Go to the Start menu, select Run, and type in regedit. This will launch the Registry Editor.
2. In the left pane, open HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\SETUP.
3. In the right pane, scroll down till you see SourcePath. Double-click on it.
4. Change the path (i.e. E:\win98cd\win98) to your own setup directory (i.e. C:\WINDOWS\OPTIONS\CABS\). Note: You must have the backslash at the end of your path.
5. Close regedit

If you want to extract just one file, you know the name of it and you know where you want to extract it to, in System File Checker, choose "Extract one file from installation disk" and point it at that Cabs folder as the place to extract it from.

For the downloading problem...in Internet Explorer, go to Tools>Internet Options>Advanced tab. Scroll down to and put a check in "Notify when downloads complete," click OK. That should restore the "Save or Open" dialog box when starting a download.

nureyev · #11 March 12th, 2004, 05:03 PM

Quote:

Originally Posted by Miz

The Options/Cabs folder Mike referred to contains the files which are on the Windows CD that are accessed when SFC is extracting files to replace.

Since you don't have a Windows disk, that folder is quite important. If you have any way to make a CD, I suggest you burn that folder to a CD.

There is a registry edit that will make Windows look to that folder instead of asking for the CD (that you don't have).

Usual warning: Editing the registry incorrectly can render your computer unbootable so proceed with caution. That said, don't be intimidated. Follow the instructions below carefully and it will work. Just don't get in a hurry and you might want to back up the entry you're going to change so you can restore it if you want.

The steps:
1. Go to the Start menu, select Run, and type in regedit. This will launch the Registry Editor.
2. In the left pane, open HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\SETUP.
3. In the right pane, scroll down till you see SourcePath. Double-click on it.
4. Change the path (i.e. E:\win98cd\win98) to your own setup directory (i.e. C:\WINDOWS\OPTIONS\CABS\). Note: You must have the backslash at the end of your path.
5. Close regedit

If you want to extract just one file, you know the name of it and you know where you want to extract it to, in System File Checker, choose "Extract one file from installation disk" and point it at that Cabs folder as the place to extract it from.

.

Thanks Miz!

As for this:
<<For the downloading problem...in Internet Explorer, go to Tools>Internet Options>Advanced tab. Scroll down to and put a check in "Notify when downloads complete," click OK. That should restore the "Save or Open" dialog box when starting a download.

__________________
>>

I went into IE (theres an icon on desktop) and this box IS checked there.
But I'm using IE6 (I don't click the IE desktop icon to go online, I sign in to MSN)...I looked for this under Settings (from toolbar), Internet Options, and the closest I could find was under Download Managers settings, and again this option is enabled....I don't seem to have a "Tools" key on my MSN9 toolbar.... ????

mike · #12 March 13th, 2004, 06:10 AM

Hi nureyev,

Do you have an IE icon on the desktop?
Right-click on it....choose "Properties"---"Advanced" , and follow Miz`s directions.

Cheers.