Corrupt Files???

[beginner33]

Could someone please help me to fix this?!?

C:\WINDOWS\WSCRIPT.EXE file
C:\WINDOWS\SYSTEM\WSOCK32 DLL file
appear to be corrupt, reinstall the file and try again.


It keeps showing up and now I can't use 'save as' to save web page,
I can't print, my desktop property doesn't react properly. It also
crashes with other errors like,

OD 17BF:00001165
OD 0147:00005ED2

It started yesterday when I tried to watch 150K stream with media player
and it crashed.

Do I need to reformat Windows or can I just reinstall those corrupt
files somehow?

Thank you.

[sea69]

you have a virus, close outlook express immediately and go here (http://www.pchell.com/virus/stagesworm.shtml)


ultimately you will need to go and get this (http://www.symantec.com/avcenter/venc/data/fix.vbs.stages.html)

http://www.PCGuide.com/ubb/wink.gif

------------------
sea1_69@hotmail.com

homepage (http://www.seanweb1.homestead.com/index.html)

[This message has been edited by sea69 (edited 03-25-2002).]

[beginner33]

hello,

Thanks for your advice. I am very devastated about this virus thing...

I tried to download the fixlife.exe but my PC doesn't let me.
When I hit save it to desk, the whole window vanishes...

I don't recall opening any jokes on notepad around the time
this sysmptoms started. I tried to watch a 150K steam on one of the
music group's *official* site with media player.
Could this cause this corrupt files?
Because it started right after I watched the stream.

OK, if this IS a virus and I can't download this fix file,
what could I do to remove this?

Thank you so much for your help! http://www.PCGuide.com/ubb/frown.gif

[sea69]

**close AND do not OPEN Outlook Express**- #1)

go and get a hotmail or yahoo email account and post it here and I will send the file to you- be sure to open/save it to YOUR DESKTOP!

AS ADVISED IN THE SYMANTIC WARNING PAGE.



------------------
sea1_69@hotmail.com

homepage (http://www.seanweb1.homestead.com/index.html)

[beginner33]

hi,

This symptoms are getting worse every time my PC hang when the blue
*Fatal Errors* come up and I'm forced to shut down improperly.

Task bar icons stopped showing up (I had MSN msger, netzip, McAfee, etc..)

'SYSTEM\WSOCK32 DLL corrupt' error & illegal operation at startup


I'd like to test if I've got this VBS virus but I don't know how.
Because Windows doesn't let me download this cure by vanishing the window when I hit 'save it to disk'.

I closed the Outlook Express.


* what I CAN NOT do....

'save as' web page/picture--> OE at BFF9DFFF and other errors and freeze
(in file menu and right click on the object)

when hit print, little warning window w no content pops up and unable

can't download files off the web (audiogalaxy is working for MP3)

Desktop property (wallpaper disapears every restart)


I still can get online, media player is fine, download digital camera pics.
Editting (rename etc) those pix in the software is ok but 'save as' doen't work either.

Please help me to get rid of this. It's getting worse and I don't know
what I can do to at least test if I've got virus.

Thank you.

[sea69]

if you will not follow instructions you are looking at paying for either a MAJOR REPAIR BILL or buying a new computer.

Please follow instructions sugestions above.. where is the email I asked for??

you do NOT have much time, and I am done with you if you won't do what I suggest.

I would imagine by this time tomorrow you won't have a pc to post here from. (at least not that one)


you don't NEED to "test" for the virus you already CERTAINLY have it!


I don't get it- what part do you not understand????


http://www.PCGuide.com/ubb/mad.gif

perhaps if ONE OF MY FELLOW "GEEKS" WERE TO TELL YOU THIS AS WELL????

------------------
sea1_69@hotmail.com

homepage (http://www.seanweb1.homestead.com/index.html)

[This message has been edited by sea69 (edited 03-26-2002).]

[beginner33]

Hello,

No no sea69, I wasn't ignoring your advice. I am really apprciated for your time and help for me.

As soon as I read your post, I sent a mail to your hotmail account and I was waiting for your reply with the fix file all day yesterday. I thought
that was what you were suggesting and I didn't want to put my account in the public.

I put *virus cure [PC Guide Forum]* in the subject line if it hadn't been deleted yet... Could I send another mail to your hotmail account?

I am sorry if I misunderstood your advice. I'd be very appreciated for your help, sea69.

Thank you.

[sea69]

sorry for being so harsh- checking hotmail now.. stand by.

http://www.PCGuide.com/ubb/wink.gif



------------------
sea1_69@hotmail.com

homepage (http://www.seanweb1.homestead.com/index.html)

[beginner33]

Dear Sea69,

I just set up my new account--> beginner_33@hotmail.com

I'd be checking my inbox and post the updates.

Thank you ever so much!!!

[sea69]

file sent- please try it right away, I would suggest doing so offline, and with your current anti-virus (if you have one) turned OFF.

because it too has been corrupted.

.

http://www.PCGuide.com/ubb/wink.gif


------------------
sea1_69@hotmail.com

homepage (http://www.seanweb1.homestead.com/index.html)

[This message has been edited by sea69 (edited 03-26-2002).]

[beginner33]

Hi, sea69

Thank you so much for your mail with the file!!!

I've tried to download it a few times now.
For some reason it takes so long after I hit *Download File*.
I haven't got to the *save it to disk* window yet.

I'll keep trying and follow your instruction
when I manage to download it.

Thanks for all your care and advice, sea69.

I'll keep updating the status! http://www.PCGuide.com/ubb/smile.gif

[sea69]

if you have the email, you should have the file as it's an attachment, maybe it's a hotmail thing, but you should just be able to open it and save to desktop.

I can resend thru real email .. and we will see.


don't worry about me getting it, I have safegaurds.

but perhaps reply to my hotmail instead of outlook mail.

heh


http://www.PCGuide.com/ubb/wink.gif

------------------
sea1_69@hotmail.com

homepage (http://www.seanweb1.homestead.com/index.html)

[This message has been edited by sea69 (edited 03-26-2002).]

[YODA74]

??? You might have to send it to a different pc D/L to a Floppy and go that route?? that Virus has probobly got you Good? Hope you made a set of recovery floppyies you might need them? With that wsock being hit you may play hell D/L anything?

------------------
Death has come to our windows.

-- Jeremiah 9:21
(undoubtedly a Biblical reference to a Microsoft product!)

YODA74@windows-sucks.com



[This message has been edited by YODA74 (edited 03-26-2002).]

[beginner33]

Hi,

I've been trying but my PC doen't let me download it.
When I hit *save this file to disk*, the window either disappear or freeze.

I'll try to download it to a floppy from another PC tomorrow and follow the instruction.

Otherwise I'll take it to repair shop before more damages are done.

Again, THANK YOU so much for your help. ^_^ I am so grateful!


a beginner ~~~ http://www.PCGuide.com/ubb/smile.gif

[sea69]

yes- definitely do as YODA suggested above- get it on a floppy from another (uninfected) machine -(one you have not sent any email to lately)

then maybe you won't need to take it to a shop, maybe we can help- depends on how far it's gone.

don't even know if it would be better to just leave it on and alone, or turn it off until you have the file.


http://www.PCGuide.com/ubb/smile.gif



------------------
sea1_69@hotmail.com

homepage (http://www.seanweb1.homestead.com/index.html)

[beginner33]

Hi,

I was looking at C: and saw something...

It's a shortcut and there was its original of
*HELP.VBS* at C:CPQDRV....

Is this part of the VIRUS I'm looking for???

It's created a week ago...

I'm getting a floppy tomorrow but should I take it to repair?
I'd like to minimize the damage if it's not too late...
I'm not sure if I manage to delete all the stuff manually.
When I get the file, is it fairly easy to fix?

Thank you for all your support... I need your help, please http://www.PCGuide.com/ubb/frown.gif

[beginner33]

Hi,

I was looking at C: and saw something...

It's a shortcut and there was its original of
*HELP.VBS* at C:CPQDRV....

Is this part of the VIRUS I'm looking for???

It's created a week ago...

I'm getting a floppy tomorrow but should I take it to repair?
I'd like to minimize the damage if it's not too late...
I'm not sure if I manage to delete all the stuff manually.
When I get the file, is it fairly easy to fix?

Thank you for all your support... I need your help, please http://www.PCGuide.com/ubb/frown.gif

[beginner33]

Sorry for the duplicate posts...
I accidentally hit BACK and resend the same message.

I've read some Virus articles.

Mine seems to be VBS/Haptime@MM or VBS/HELP (Panda).

I have a question about the fix file, please?
Does the fixlife.exe works for any VBS virus?

I'll get it to a floppy for the first thing tomorrow.


Thank you very much http://www.PCGuide.com/ubb/cool.gif

[sea69]

the more you use this until you get it repaired the more damage you do, that's why I posted:

don't even know if it would be better to just leave it on and alone, or turn it off until you have the file.



now disconnect and go to sleep!

lol

http://www.PCGuide.com/ubb/wink.gif



------------------
sea1_69@hotmail.com

homepage (http://www.seanweb1.homestead.com/index.html)

[beginner33]

Hi,

I know... thanks for all your help and warnings!

I left my PC alone and now I'm waiting for my floppy.

So this fixlife wokrs for this kind of VBS virus, also?

This *HELP.VBS* and its shortcut, in C:,
Should I delete them right away?
Or should I wait for the floppy and do everything at once?

Thanks!

[beginner33]

Hi,

I tried the VBS Haptime Fix and results were:

****************************************
The VBS.Haptime.A@mm / VBS Haptime.B@mm
infection as been successfully eliminated from your machine

scanned files 20379
deleted files 4
repaired files 1075
registry keys fixed 5

****************************************

Does it look good?

But my PC still act still strange and I don't want to mess with it
in case the virus is still hiding.

I still see a shortcut of *help.vbs* in :C
Is it supposed to be there?

I also see 5 htm. extension files in WINDOWS.
2 of them are wallpapers I used when I think I triggered the virus.

I have a question, here is what's written:

what the tool does...
*The fix tool will not repair the files dropped by the worm*

Does this mean after I run the fix, I still have to do something?

I don't want to make it worse by touching anything.

Could you please give me further instruction, please?


Where are you~~~~~~~~~, sea69~~~~~~~~ http://www.PCGuide.com/ubb/redface.gif !!!!!

[YODA74]

Have you updated your virus definitions and run a regular virus scan? do that, if those screen savers are something you D/L delete them. There should have been a read me file on the symantic site on this virus you need to read and make sure that everything is cool Looks like it to me but you may have to fix some files which i dought seems this was only a catigory 2 virus.You should be good to go as far as the help.vbs file ??? i think you have to have it but am not posative I would hardley think so seems this is what Help start this.

------------------
Death has come to our windows.

-- Jeremiah 9:21
(undoubtedly a Biblical reference to a Microsoft product!)

YODA74@windows-sucks.com

[This message has been edited by YODA74 (edited 03-27-2002).]

[sea69]

did you disable "Auto Protect" prior to running the fix??

Absence of .DLL and .EXE files
- Increase in file length of .ASP, .HTM, .HTML, .HTT, and .VBS files
- Presence of HELP.HTA, HELP.VBS, HELP.HTM, and UNTITLED.HTM files

are symptoms of it being there yet, but the above says it has been eliminated.

what operating system are you on- please don't tell me winME...

[YODA74]

whow, I guess I better go read the site! hey sea sorry if I gave misleading info on this.Thats why I'm still learning to. http://www.PCGuide.com/ubb/wink.gif

------------------
Death has come to our windows.

-- Jeremiah 9:21
(undoubtedly a Biblical reference to a Microsoft product!)

YODA74@windows-sucks.com

[beginner33]

so GREAT to see you guys, thank you!!!

Here are answers to the questions:

* about Virus scan

I haven't run the current virus scan (McAfee) yet.
I was a bit confused if it's infected and I shouldn't use or not.

I updated the virus definition files after the fix.

Should I run it? If so I should choose *all files* ?


* about those fishy files existance...

BEFORE running this fix

the shortcut *help.vbs* in :C was created on Mar.18
the original was in C:CPQDRV

NOW, I check the property of the same shortcut it says
created Mar 27 and time is when I run the fix
can't target the original....
and the original one I saw in CPQDRV seems to be gone..


Those htm. files are picture files which I downloaded
a long time ago and used as wallpaper time to time,
I wonder why they are in WINDOWS file?

Those 3 picture files were the ones I used last week or so
when my PC seemingly got infected...

Besides they were *bmp.* when I saved them....
I think it's strange they are *htm.* in CPQDRV.

Other 2 *htm* files in WINDOWS are
HTMLHELP.HTM and README.HTM and created today when I run the fix

I've never took a good look at system/program files before
and no idea which ones are supposed to be there.

* Auto Protect?

Could you explain this for me, please?
I thought it was to turn off the current V-scan which I did.
If not, could you tell me how to do so with McAfee?
Then I'd have to run the fix, again?

* My OS is Windows 98 SE

I also noticed the font when I type (usename for web etc.)
seems to be changed. Some icons are a little bit messy.
Still unable to right click to same pix...

Am I supposed to restart the PC after fix?
I haven't done so..
I was afraid to make it worse by rebooting it
before making sure, in case of the virus still present.


Thank you so much for all your advice.
I'll take every suggestion and try my best to get rid of this.

Thanks http://www.PCGuide.com/ubb/smile.gif ~~~

[sea69]

I would uninstall macafee completely, and delete all registry entries for it as well

then if you have the cd reinstall it or go and get AVG (http://www.grisoft.com/html/us_index.htm)- for free.

(I use it)

Other 2 *htm* files in WINDOWS are
HTMLHELP.HTM and README.HTM and created today when I run the fix

I believe these are correct and should be there.

Besides they were *bmp.* when I saved them....
I think it's strange they are *htm.* in CPQDRV.

these I would delete.

forget about auto protect- you did it right.

absolutely- reboot.

in fact do that before the above and recheck.

reason I asked about winME is you would have needed to turn system restore off.

n/a for win9x.

http://www.PCGuide.com/ubb/wink.gif



------------------
sea1_69@hotmail.com

homepage (http://www.seanweb1.homestead.com/index.html)

[beginner33]

Hello, again


I rebooted.
*illegal operation* warning appeared twice before restarted.
I think the virus is still hiding...


I'll delete the McAfee as you suggested.
*Registry entry* ???
Is that those shortcuts?
Or is it registry where I type in the run window?
Sorry I'm such a clueless...


I'll have *Norton* tomorrow and I'll download McAfee, too.
I read it's good to have more than one/one brand??


I deleted those *htm.wallpaper pix files* as you suggested.

How about the shortcut of help.vbs in :C ?


I don't know why it hasn't improved yet after the fix. http://www.PCGuide.com/ubb/rolleyes.gif
It said virus was eliminated...

Do you think I should try the manual removal when I get Norton?

I read:
http://securityresponse.symantec.com/avcenter/venc/data/vbs.haptime.a@mm.html

I think I can handle removing the worm and deleting the htt.files.
I wouldn't want to mess with the registry.
Besides the fix reports there were 5 registry key fixed...

Please tell me what's the best thing to do next.


Thank you very much as always http://www.PCGuide.com/ubb/wink.gif

now I'll rest and rest the PC as well ~~~ http://www.PCGuide.com/ubb/tongue.gif

[sea69]

I hope you didn't "delete" mcafee, I hope you UNINSTALLED it.

get Norton and run it )or get the free one I advised)- forget mcafee.

forget about editing the registry.

in you can follow the norton instructions then by all means do/

http://www.PCGuide.com/ubb/wink.gif

good luck, glad we could help a little bit.




------------------
sea1_69@hotmail.com

homepage (http://www.seanweb1.homestead.com/index.html)

[bassman]

BEAUTY JOB SEA, nice call.

Hopefuly, Beginner, you can get AVG or Norton to find more. Some of the continuing problems you are having are probably from dropped files.

what the tool does...
*The fix tool will not repair the files dropped by the worm*


You may still be in for some reinstalling or deeper repairing http://www.PCGuide.com/ubb/frown.gif

Good luck

------------------
A real Christian is one who can give his pet parrot to the town gossip.
Frank's Place (http://dreamwater.net/tech/frankscomp/)

[beginner33]

Hi,

My friend tried to download *Norton* today
but it didn't work.

We needed *service package* (?) to make it work with 98,
the window disappears or hangs as we try to download...

I guess it's because of those lost files.
I'd have to fix it first before anything.


My OS is 98SE and using Compaq Presario 7478.
It came with 2 Quick Restore disks.

My friend tried the Built-in Technician but HE also Disappears..
I could try again myself but I doubt it'd work...

My question is,

Is there any way, it recognaizes what's missing
and reinstall if I could get it work???

or

Should I reinstall everything with the disks and
I can completely get rid of the virus for sure???

I know I'd lose personal files but I can live w/o it.
Besides it'd be better off to start all over
with the best protection and everything.
I just want to make sure the evil Panda virus is gone!


THANK YOU so much for all the advice and encouragement http://www.PCGuide.com/ubb/smile.gif

It's been a tremendous help for me, especially *sea69* http://www.PCGuide.com/ubb/biggrin.gif

[sea69]

yes, by all means since you have the restore disks go ahead now and do a FULL Restore in order to get a fresh start.

**again the reminder **all** data will be **LOST** - the pc will be just as you started it on day one.**

follow the onscreen instructions, it's relatively simple to do.

http://www.PCGuide.com/ubb/wink.gif

------------------
sea1_69@hotmail.com

homepage (http://www.seanweb1.homestead.com/index.html)

[This message has been edited by sea69 (edited 03-28-2002).]

[bwlautt]

If your not confortable with editing the registry then yes use the quick restore disks. I know Norton gives detailed instructions on how to remove the virus for good. Just hate to see you format your HD and you might check into it and see if the restore disks will give you a fresh MBR as well as some viruses like to hid in those areas.

[Paleo Pete]

Our policy here is to use a format/reinstall as a last resort only, but this is one of those situations that I think a reinstall is probably the only way to get the computer running right again. When a virus hits it can cause some really weird behavior...corrupted files, changing icons, disabling certain functions and usually the only way to get the machine to run right again is either some serious registry editing or a reinstall.

I would say get a KNOWN CLEAN and WRITE PROTECTED Win98 start up disk and run fdisk_/mbr from the DOS A:\> prompt to try and clean up the MBR. Use a space in place of the underscore ( _ ) used here. You might even run that command twice, rebooting between, although I'm not sure that would be necessary. I do it when I think I might have a problem in the MBR. (Master Boot Record) When booting with the start up disk choose either with or without CD ROM support, the CD ROM won't be needed to run fdisk.

NOTE: DO NOT use a start up disk made on this machine. Make one on another win98 machine known to be virus free or download one at Bootdisk (http://www.bootdisk.com).

Then format C drive, the restore disks will replace everything. Compaq's often store part of the BIOS on a hidden partition, but that shouldn't be affected by formatting C drive, it's a different partition. After formatting then run the restore disks, and use the Full Restore option, NOT Quick Restore. Boot with the clean Start Up disk, and choose Start with CD ROM Support to run the restore disks.

------------------
If your nose runs and your feet smell...
You're built upside down!
Note: Please post your questions on the forums, not in my email.

Computer Information Links (http://www.dreamwater.com/paleopete/computer.htm) has been moved, please update your bookmarks.

[beginner33]

http://www.PCGuide.com/ubb/smile.gifHELLO http://www.PCGuide.com/ubb/smile.gif ,

With all of your advice and my friend's help,
my PC is back and healthy again! http://www.PCGuide.com/ubb/wink.gif

I did Full Restore and Norton & Fire wall are installed.

I am so grateful for all your reply!!!

If I didn't come cross to this Forum,
I wouldn't have made it before my PC got destroyed.

http://www.PCGuide.com/ubb/biggrin.gif THANK YOU ever so much http://www.PCGuide.com/ubb/biggrin.gif

[sea69]

alright!

glad it all worked out!


http://www.PCGuide.com/ubb/wink.gif



------------------
sea1_69@hotmail.com

homepage (http://www.seanweb1.homestead.com/index.html)

[Alchemist]

lolz http://www.PCGuide.com/ubb/biggrin.gif
should have format it and reinstall it in the first place then no need to worry so much... http://www.PCGuide.com/ubb/cool.gif

remember use norton anti-virus program and update it weekly and scan ur pc for virus every 2 week in this way u get less chance of infection. http://www.PCGuide.com/ubb/biggrin.gif

------------------
Resistant is Futile..
Aurora and time is the keyz to victory