Re: Program Startup Problems

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: R. C. White (rc_at_corridor.net)
Date: 12/05/04 

Date: Sun, 5 Dec 2004 11:12:22 -0600

Hi, Nigel.

Just like your post, the Subject line (sometimes called the Header) does not
usually say much about "malware" or "safe hex", even if that turns out to be
the actual problem. You'll have to pick a few likely headers and check the
actual text of the message - and the responses from MVPs and others.

For example, here's a thread started by "Sleep deprived" just about an hour
before your post:
Help with slow PC...exe files seem to be taking over

That Subject line says nothing about malware, but MVP Malke Routh's response
has excellent step-by-step instructions to cure the poster's immediate
problem and to guard against future infections.

The Thread started by Chiara Popalopa on 12/2/04 with the Subject line "Re:
Safe Mode and spyware" is 10 posts long, so far. Several of those posts
details steps that you should take, or at least consider.

Many MVPs spend a lot of their time helping their employers, customers and
friends recover from malware infestations and guard against future problems.
Those MVPs know much more about this than I do, since I'm mainly concerned
with just my one computer, which stays clean with minimal effort on my part.
I just make sure to visit Windows Update at least weekly (It's set to update
automatically, anyhow, but I like to do it manually now and then, just in
case.), run a good firewall and antivirus - and NEVER click "Free" offers,
thereby inviting malware to invade my computer.

It took me only a few minutes to scan these headers and find the responses,
Nigel, and I could find dozens more in less than an hour, I'm sure. If you
really want to find out about "safe hex", there's plenty of information and
advice to be found.

RC 

-- 
R. C. White, CPA
San Marcos, TX
rc@corridor.net
Microsoft Windows MVP
"Nigel Barraclough" <nngbarraclough@nospam.hotmail.com> wrote in message 
news:uOWSV7h2EHA.3132@TK2MSFTNGP14.phx.gbl...
> Thanks again for the advice.  With regard to "safe hex" I have downloaded 
> the headers back to 12 November and cannot find anything like this.  Can 
> you point me in the right direction please.
>
> Nigel
> "R. C. White" <rc@corridor.net> wrote in message 
> news:ui5EmGY2EHA.2608@TK2MSFTNGP10.phx.gbl...
>> Hi, Nigel.
>>
>> I'm glad to hear that you were able to get back on-track with Ad-Aware 
>> and SpyBot.  ;<)
>>
>> Now, be sure to stay on-track by practicing "safe hex".  Full 
>> instructions are posted in these WinXP newsgroups several times nearly 
>> every day - and they are quite long, so I won't bother to repeat them 
>> here.  Just scan through a day's worth of messages here and you should 
>> see them several times.
>>
>> Recognize that there are several classes of malware in addition to 
>> viruses: spyware, adware, pop-ups and others.  Antivirus software is not 
>> designed to catch these.  That's why we need SpyBot, etc., in addition to 
>> AVG or another antivirus.  Also, we must stay up-to-date by visiting 
>> Windows Update often; it's best to set it to update automatically.  And 
>> be sure to install and use a good firewall.
>>
>> Good luck!
>>
>> RC
>>
>> "Nigel Barraclough" <nngbarraclough@nospam.hotmail.com> wrote in message 
>> news:uGUSAXW2EHA.936@TK2MSFTNGP12.phx.gbl...
>>> Thank you for your thoughts.  I tried working down your list although I 
>>> didn't understand what the results of Path and Set told me.  I do run 
>>> AdAware and Spybot regularly and did so before installing SP2.  However 
>>> I ran them just now and AdAware picked up a nasty which looked likely to 
>>> be the cause HKEY_CLASSES_ROOT: exefile\shell\open\command"" () possible 
>>> virus infection, executable file extension compromised.  I got rid of 
>>> this. Spybot picked up some other things mainly associated with Media 
>>> Player which I told it to fix.
>>>
>>> At first glance, and I haven't done much testing yet, this seems to have 
>>> sorted things out.  I am most grateful.
>>>
>>> How these things got there as I use AVG, which I keep up to date, is a 
>>> bit of a mystery.
>>>
>>> "R. C. White" <rc@corridor.net> wrote in message 
>>> news:e1pgrxV2EHA.1400@TK2MSFTNGP11.phx.gbl...
>>>> Hi, Nigel.
>>>>
>>>> That's weird, I agree!  But I see no reason to suspect SP2.  What were 
>>>> the "couple of other updates" that you installed?  Were those from 
>>>> Microsoft?
>>>>
>>>> HOW do you start Access and Excel?  Do you click on their icons in All 
>>>> Programs, or by some other means?  What happens if you use Windows 
>>>> Explorer to navigate to Office\Office10 and then click on Excel.exe? 
>>>> Or on MSAccess.exe?
>>>>
>>>> If Access and Excel start properly from their .exe files, then maybe 
>>>> all you need to do is create a new Shortcut for each of them. 
>>>> Right-click each of the icons that you normally use and choose 
>>>> Properties to see what is there for each icon.  See if the settings for 
>>>> Access include the "option that Microsoft Access doesn't recognise". 
>>>> See if it tells Access to open Microsoft.mdb; also check the Excel 
>>>> shortcut for instructions to start Microsoft.xls.  Those files are not 
>>>> included in Office itself.  Are they files that YOU created?  If you 
>>>> are using batch files to start Access and Excel, then check the 
>>>> contents of the .bat files.
>>>>
>>>> To check your Path, open a "DOS" window and type Path to see only the 
>>>> Path variable, or Set to see a list of all your environment variables, 
>>>> including Path.
>>>>
>>>> As you probably know, IEExplorer.exe is NOT a valid WinXP filename, but 
>>>> maybe that was only a typo.  The correct path to Internet Explorer is 
>>>> \Program Files\Internet Explorer\iexplore.exe
>>>>
>>>> If none of these steps turn up any of your own tweaks to your computer, 
>>>> then you may be the victim of some kind of malware.  Do you regularly 
>>>> run anti-malware programs, such as Ad-Aware and SpyBot?
>>>>
>>>> RC
>>>>
>>>> "Nigel Barraclough" <nngbarraclough@nospam.hotmail.com> wrote in 
>>>> message news:uKtQHfU2EHA.1564@TK2MSFTNGP09.phx.gbl...
>>>>>I installed SP2 and a couple of other updates.  It may or may not be a 
>>>>>coincidence that I am now having problems starting many programs which 
>>>>>worked fine before.  Some do not start at all.  Others start with error 
>>>>>messages but run fine after that.
>>>>>
>>>>> In Access the error messages are "The command line you used to start 
>>>>> Microsoft Access contains an option that Microsoft Access doesn't 
>>>>> recognise" followed by Microsoft Access can't find the database file 
>>>>> 'Files\Microsoft.mdb'".  Access then opens and works fine
>>>>>
>>>>> In Excel it is "'Files\Microsoft.xls' could not be found" followed by 
>>>>> "'Office\Office10\Excel.exe' could not be found".  Excel than opens 
>>>>> and works fine.
>>>>>
>>>>> In IE6 I get "http:\\files/Internet%20Explorer/IEExplorer.exe" in the 
>>>>> URL line.  If I click on my home page (Google) IE6 works fine.
>>>>>
>>>>> In Nero it is "c:\program files\ahead Nero\files\ahead\Nero\nero.exe 
>>>>> contains an invalid path".  The correct path to Nero is c:\program 
>>>>> files\ahead\Nero\nero.exe.
>>>>>
>>>>> There are many other failing or error ridden startups.
>>>>>
>>>>> What this suggests to me, as a non-expert, is that something has 
>>>>> corrupted the paths used to open applications by adding extra bits to 
>>>>> the path - like the extra "files\ahead\Nero" to the Nero path..
>>>>>
>>>>> Has anyone got any idea what is going on and what I should do about 
>>>>> this. If no-one has any ideas I will have to try an earlier restore 
>>>>> point and/or uninstalling SP2.

Relevant Pages

  • Re: Faked Header ?
    ... | The header isn't what you have to worry about. ... A very *NASTY* trojan that installs a combination of; ... I want to know if the headers are faked or are they real or are they BOT generated. ... I get new malware samples from there. ...
    (news.software.readers)
  • Re: Best procedure to run anti-virus scan?
    ... | Save a log of what's happened and if malware ... Anti Malware will find them hidden or not. ... | Needed for "safe hex", along with "Do NOT hide file name extensions". ... | May not be able to resolve per-account settings. ...
    (microsoft.public.security.virus)
  • Re: Protecting against malware with combinations of free programs
    ... Safe Hex is as important then as it is now. ... PC (keeping it infection-free) is just as, if not more so, ... or will function autonomously to keep itself free of malware. ...
    (alt.comp.anti-virus)
  • Re: VirusBursters - How Does it Get Installed?
    ... are already infected and the malware is busy downloading more malware, ... variant of the Smitfraud trojan. ... There are a lot of "Safe Hex" sites for you to point your daughter and ...
    (microsoft.public.security)
  • Re: Virus origin
    ... > I know that malware programs typically spoof the 'From' header, ... "Received:" headers are faked by many spammers and viruses. ... you'll get the name of the ISP it belongs to. ... web hosting service, of course, so that's not conclusive. ...
    (alt.computer.security)