Thank You Hked For The Help. Now Next Puzzler.

thedadof42000 · #1 June 22nd, 2002, 06:32 AM

OK I HOPE BY MY SCREEN NAME YOU FIGURED OUT I'M THE ATHER OF 4 DELIGHTFUL CHILDREN.

BUT ONE OF MY ANGLES HAS DELETED SOMETHING THAT LEAVES THIS MESSAGE WHEN WE START THE COMPUTER. "FILE SGVGORE.VBX IS NOT FOUND" ABOVE THIS IT SAYS WIN32 SYS. NOW WHEN WE CLOSE THIS PROMPT THE COLOR OF THE SCREENSAVER AND WALLPAPER CHANGES COLOR AND ALMOST LOOKS LIKE A NEGETIVE. ANY IDEAS ARE GREATLY APPRECIATED. AGAIN "HKED" THANK YOU FOR THE HELP. AND WHO KNOWS I PLAY WITH THIS THING LONG ENOUGH. I JUST MIGHT GET TO KNOW WHAT I'M DOING.

HKEd · #2 June 22nd, 2002, 12:50 PM

Hi Dad...how are the 4?

Please try and keep all your issues in the same thread by using the Reply button.

The Tools menu is just to the right of Favorites in the IE toolbar. As for your other problem, it sure sounds like a worm (Benjamin?). There's a free virus checker here - let us know what it reports.

HKEd · #3 June 22nd, 2002, 01:11 PM

Oops...I must be dumb, but I can't find the virus checker that used to be on this site Try this:

http://housecall.antivirus.com/housecall/start_corp.asp

**MishY** · #4 June 22nd, 2002, 01:53 PM

Heya HKED

It's still there, but what with the redesign of the site, and file extension change of almost every file, I can appreciate it must've been hard to find.....Here ya go :-S

http://cybertechhelp.com/html/misc/av.php

thedadof42000 · #5 June 23rd, 2002, 03:26 AM

RAN THE VIRUS SCAN DID NOT FIX PROBLEM. ANY OTHER THINGS I
COULD TRY?

**smurfy** · #6 June 23rd, 2002, 06:30 AM

Hi there dadof42000, thanks for clarifying the username, otherwise we may have thought you were very verile!

Please do us a favour and stop typing ALL IN CAPS.

Sounds to me like your video drivers have been tampered with.

Right click "My Computer" on your desktop and select "properties".
Click on "Device Manager" tab.

Tell us what is listed under "Display Adapters" if it is anything other than "Standard VGA".
If it says "Standard VGA" can you please tell us exactly what make & model PC you have so we can help you find drivers for it.

thedadof42000 · #7 June 23rd, 2002, 07:19 AM

Sorry about the caps being on. Well under Display Adapter it
says "S3". Nothing else.

**smurfy** · #8 June 23rd, 2002, 12:52 PM

Hmm, that means windows at least thinks it knows what you've got.

Boot into safe mode
(as You reboot the PC hit F8 immediately after you see starting windows 95... before you see the windows clouds splash screen)
and return to device manager and remove the S3 display adapter and reboot.
Windows will rediscover the display adapter and either reinstall drivers or prompt you for Windows CD to enable it to find drivers.

If still no go, post back and tell us the full specs (make & model) of that machine because S3 is only really a chip manufacturer, not the model of the chip so we may still need to find you some good drivers.

p.s. Thanks for the change in type style

thedadof42000 · #9 June 23rd, 2002, 07:29 PM

Tried the reboot and all. Still showing S3 as display adapter.
What info do you need and and where is the best place i can find the info? this puter is a used one. Do not know all the details about it.

HKEd · #10 June 24th, 2002, 05:44 AM

Hi again. Everything I read indicates that Win32.sys message points to an infection of some kind. It apparently is called from win.ini, or maybe the registry. Go to Start > Find > Files or Folders and type pkg*.exe in the Named box and click on Find Now. Repeat the process for Win32sys.exe. Let us know if you find them.

Next, go to this link:

http://home.earthlink.net/~rmbox/Ret...d/Only_IE.html

Download StartLog.com to your desktop, then double-click on it to run it. It will generate two text files - Startup.log and StubPath.txt. You can delete the latter - it's not needed in this case. Startup.log opens in NotePad, so go to Edit > Select All > Edit > Copy, then Paste the contents in your reply for analysis.

HKEd · #11 June 24th, 2002, 05:44 AM

Oops...sorry about the double post. I guess my trigger finger is a little twitchy this a.m..

mike · #12 June 24th, 2002, 12:11 PM

Hi Dadof4,

Hi HKed,

Rm-box will show it up.

Symantec have mention of Win32sys.exe and Pkgxxxx.exe

and list them under AOL-PWS ...Password Stealers and

credit card info gatherers.

Link to info:
Detection and Removal instructions.

Also can try a scan here :

Symantec Online scan and choose the "Scan for Viruses"

**edit to fix URLs**

**smurfy** · #13 June 24th, 2002, 12:48 PM

Mike & Ed - thanks guys.
(Mike - I fixed the urls in that post - somehow your copy & paste inserted <&nbsp> tags in there).

I had kind of assumed here that the Trend Houscall had cleaned whatever the virus/trojan was but we were left with missing files (uncleanable) that have meant no video drivers.

thedadof42000, up to you now depending on where you are up to:
1) If Housecall did not stop the error messages on boot up, you'll need to continue to follow Ed & Mikes excellent advice.
2) If you no longer have these errors but still have bad desktop we need to continue along my path.
Download the belarc advisor which will probe your system and tell you lots about the hardware & software on it.
http://www.belarc.com/
Should give you motherboard make & model which we can use to find out what video drivers you need.

thedadof42000 · #14 June 26th, 2002, 10:19 PM

I'm back. Tried to find pkg*.exe &Win32sys.exe. Neither were on computer. will try next step.

thedadof42000 · #15 June 26th, 2002, 11:45 PM

The specs on this puter are: IBM PC456A0123; processor: 97mg
AMD486DX; Main circuit board: bios 5/5/97; Hard drive: DALA 3540; CD-ROM: Mitsumi FX810T4!B; Display: S3 AOCcm 324
monitor; 20mg installed memory. don't know if you need any more let me know.