errr, i broke windows 2k

[Clowneh!]

Windows 2000 Service Pack 4

i thought it was supposed to be the most stable or summat

anyway. when i boot up, svhost will crash or summat and then my computer will act really strange. i wont be able to open urls in new ie windows. i cant paste. i cant drag and drop. its mashed?

anything i can do or try before reinstalling?

i'll try and get you error messages when i get home, i always forget to screenie it before clicking 'ok' :/

 

[Clowneh!]

here we go...
and i may as well ask about my other error while i'm at it. when i click a media file (.mp3 / .avi / whatever) and that preview thing comes up in the left hand column... this error occurs.
http://www.clowneh.nildram.co.uk/ERROR1.jpg

while my computer was crashing, the bloody svhost error occured. they are unrelated (as in one can happen without the other one happening). MY PC IS MASHED
http://www.clowneh.nildram.co.uk/ERROR2.jpg

 

[Will]

I don't have time, but post those error messages into google if you can.

 

[Scooba Da Bass]

It's the worm that takes advantage of the RFC exploit ONCE AGAIN, THANK GOD THERE'S ANOTHER NEW THREAD ABOUT IT.

Patch, Firewall, virus check etc...

 

[Insane]

its the lovsan worm, or Blaster.worm, whatever you wanna call it.

(the 550 had the same strange problems after a while running)

you will need to run anti-virus remover to clean MSBATCH.EXE out and remove it from the registry, then run the update to remove the RPC problem.

NAI Stinger is here which will remove lovsan quickly.

download the microsoft update
(http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-026.asp)
run it and reboot.

Edit: Bah! too slow again

 

[Clowneh!]

thanks Insane

the reason why i didnt do all those other checks in the other threads, scoob, was cuz i didnt have the same problems as them so i kinda thought it was a normal windows problem.

again, thanks insane

 

[Clowneh!]

ok, i patched windows and i got rid of that worm with symantecs utility.

but 'Error 1' still happens

any ideas?

 

[Embattle]

I was going to tell you that I get that first error, but you closed the thread you spanner.

I get it now and then and it often happens when I go to close IE with WMP open, although it doesn't happen every time. It only knocks that particular IE window out and sometimes causes WMP to carry on playing even when I close it afterwards so I have to terminate it through taskmanager.

 

[Embattle]

ATM I have no idea why, although suspect some windows update has caused it although doesn't cause many problems so I'm not worried.

 

[Clowneh!]

yeh i closed it cuz there are far too many threads about this virus

its harder when explorer gets knocked out tho
all the icons in the systray goes loops and some other wierd stuff happens so that i have to reboot.

so i cant single click on files, i have to open up my favourite ftp manager and move them like that and delete them and stuff :/

booo

 

[kameleon]

give us you application error log Clowneh

 

[Embattle]

I'm using XP which might make a slight difference to the way it handles the problem, my systray icons do vanish for a few seconds but reappear when the screen seems to refresh....its only the original IE window that wipes out totally.

 

[Clowneh!]

application error log?

 

[Embattle]

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 05/08/2003
Time: 18:28:39
User: N/A
Computer: BATBASE
Description:
Faulting application explorer.exe, version 6.0.2800.1106, faulting module ntdll.dll, version 5.1.2600.1217, fault address 0x00007ec4.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 65 78 70 ure exp
0018: 6c 6f 72 65 72 2e 65 78 lorer.ex
0020: 65 20 36 2e 30 2e 32 38 e 6.0.28
0028: 30 30 2e 31 31 30 36 20 00.1106
0030: 69 6e 20 6e 74 64 6c 6c in ntdll
0038: 2e 64 6c 6c 20 35 2e 31 .dll 5.1
0040: 2e 32 36 30 30 2e 31 32 .2600.12
0048: 31 37 20 61 74 20 6f 66 17 at of
0050: 66 73 65 74 20 30 30 30 fset 000
0058: 30 37 65 63 34 0d 0a 07ec4..

Some Info:
http://www.eventid.net/display.asp?eventid=1000&source=Application+Error

 

[Clowneh!]

how do i find my one?

 

[Quige]

Looks like some of the problems were virus related, but if the other thing started at the time of SP4, you could always try and uninstall it.

there's some stuff you could try maybe here
http://www.experts-exchange.com/Operating_Systems/Win2000/Q_20404853.html

- giving the system file checker a go perhaps or having a look at what other shell extension might have installed themselves in case any are conflicting with Windows own viewer.

I think the shell extension are at this key in the registry.

HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers

You could try exporting the key to a registry file, and then deleting all the keys below this one and seing if you problem went away. If it does then reimport them, and try removing entries one by one and see you can pin down the culprit. You might have to log off and on again as you try each one, though not neccesarily a reboot.

Another thing you could try is creating another local user (copy the administrator account) on your system (assuming not connecting to a domain) and log on as that new user and see if the problem remains. If it doesn't then the problem is in the user part of the registry and not the machine part. You could just transfer to the new profile - requires a bit of setting up to get back just right, but maybe better than a complete reinstall.

 

[Quige]

Originally posted by Clowneh!
how do i find my one?

Right click on 'My Computer', select 'Manage' and then go to the Event Viewer and have a look in the Application log or the System log for the error.

 

[Clowneh!]

im logged in as administrator, and thats the only thing i could decipher from ur post. faaar too big words for my little head

http://www.clowneh.nildram.co.uk/drwtsn32.txt

i think thats my error log... fuck knows if i've just given you loads of sensitive information

 

[Clowneh!]

Event Type:	Error
Event Source:	Userenv
Event Category:	None
Event ID:	1000
Date:		12/08/2003
Time:		23:07:42
User:		NT AUTHORITY\SYSTEM
Computer:	CLOWNEH
Description:
Windows cannot unload your registry class file.  If you have a roaming profile,
your settings are not replicated. Contact your administrator.  

DETAIL Access is denied. , Build number ((2195)).

loads of these things

 

[Cdr]

Originally posted by Clowneh!

Event Type:	Error
Event Source:	Userenv
Event Category:	None
Event ID:	1000
Date:		24/05/2003
Time:		03:28:12
User:		NT AUTHORITY\SYSTEM
Computer:	CLOWNEH
Description:
Windows has crashed because you haven't paid for it.
You merely downloaded it off e-mule.

We'll now format your HDD and leave you posting on forums, 
while we watch and laugh.  

DETAIL - Access is denied. , Build number ((2195)).

Thats what it really says Clown.

 

[Quige]

I'm not that sure if the DrWatson log is related. You usually get different looking error from a DrWatson crash - it actually tells you it's writing a logfile etc.,

Did you understand my follow up post about how to get to the event logs.

From that same tool you can go down to 'Local Users and Groups' and right click and copy the administrator account to make another account with admin rights. The windows registry is mainly in 2 big parts. The users settings and software, and the machine part which holds settings that apply whoever is logged on (hardware, common windows stuff etc.)

The problem you're having might well be caused by something you've installed and it's screwed the user half of things. If you log on as a new user it should build a new profile with lots of default settings, rather any that you might have added through installing stuff.

 

[Clowneh!]

even if it's windows own preview thing that seems to be f'kin up?

:/ i dont wanna make another user really

 

[Quige]

Originally posted by Clowneh!
even if it's windows own preview thing that seems to be f'kin up?

:/ i dont wanna make another user really

But it might be windows preview thing f'kin up 'cause of another shell extension stepping on it's feet - those things that add themselves to the right click menu to make things handy. This sort of thing

The other user is really to help troubleshoot. You could delete it later if you sort your current profile out.

 

[kameleon]

found this

 

[Quige]

Originally posted by kameleon
found this

Hmm, yeah I saw that in Technet as well ... trouble is the advice is to install the latest service pack, which at the time was SP3. Given that Clowneh! has just installed SP4 I wasn't sure that it was exactly the same problem, or much of a solution.

Still if it wouldn't hurt to turn the IPSec Policy agent service on and see if it helps.

 

[Quige]

Have you just tried getting rid of the preview thing. I think you should be able to do this by going to explorer & tools folder options and then select Windows classic on the Web view options.

 

[Clowneh!]

yeh getting rid of the preview thing works, but it looks odd.

surely i can fix this problem tho?

that ipsec policy thing has always been running and the stuff on right click... all i have is scan with norton and add to rar.

i think i'll just turn to classic view whenever i need to single click these files, hehe
ill leave this thread open this time incase someone comes up with something tho, keep trying please

 

[Quige]

It might be that the templates that the preview things are made with have become corrupt. A couple of things I guess I would try.

I'm not sure if they would be considered protected system files, but as I think someone else suggested you could run the system file checker.

Get your windows 2K CD to hand, and then go to run, type cmd and then enter. At the command prompt type

c:>sfc /scannow

This will launch the sys file checker. Anything it thinks is dodgy, corrupt etc., it will copy off the installation CD. I think it's smart enough to know about any applied service packs.

The templates are in WINNT\Web and have htt extensions. If the file checker doesn't repair them and you're still getting the error, it might be worth getting someone to zip up & email you their versions. It comes to about 700K I think.

I've put mine here, but do back yours up before replacing them if you want to try it - I am running Norton with latest defs so should be OK, but of course, trust noone and scan them yourself.

http://www.yggdrasil.org.uk/quige/web.zip

You could try and find the originals packed away in the cab files on the windows CD and manually extract them, though from what you said earlier, you might consider that a bit of a techie exercise

Or you could try using the Customize this Folder option from the View menu in Explorer to lauch the customise wizard. Open up the standard template and them resave it to see if that sorts it out.

 

[]SK[]

Theres a bug in Outlook Express in Xp thats been around for ages and only happens sometimes, not seen in a long time could be patched by now. Never seen it happen to IE though. Other than that you def 100% virus free? Could be memory fubar as Dows cant write to it?