Archived from groups: microsoft.public.win98.gen_discussion (More info?)

Seemingly all of a sudden, I cannot locate or run a lot of programs I've
installed. When I try to open, I get that box that has what looks like a
flashlight searching, and says missing shortcut. On all the programs that
this happens on, the icon for the program has changed to a white box with a
blue border on top (I think this is normally how program icons look in
DOS!?)

It's as if I've lost a hole lot of shortcuts. All the programs that still
have their normal icons work properly. The ones that have the problem all
have that white/blue window icon wherever there is a shortcut to that
particular program.

I did recently install a security update from the Windows upsate site, but I
don't think this is when the trouble started.

Thanks for any advise, Todd Mcd

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

For troubleshooting, choose one of those non-working shortcuts that have the generic
Windows icon: right-click the icon, click Properties on the menu that appears, and
look on the Shortcut tab. In the Target line, what is the path? You can copy and
paste the path from that line, into a reply to this message. The path will name the
folder and file the shortcut is *supposed* to be pointing to.....apparently it is
not there, and we need to determine if it is missing, or just moved, and why.
--
Glen Ventura, MS MVP Shell/User, A+
http://dts-l.org/goodpost.htm


"Mcd" <jmcderm3@tampabay.rr.com> wrote in message
newsaibJNoeFHA.3712@TK2MSFTNGP12.phx.gbl...
> Seemingly all of a sudden, I cannot locate or run a lot of programs I've
> installed. When I try to open, I get that box that has what looks like a
> flashlight searching, and says missing shortcut. On all the programs that
> this happens on, the icon for the program has changed to a white box with a
> blue border on top (I think this is normally how program icons look in
> DOS!?)
>
> It's as if I've lost a hole lot of shortcuts. All the programs that still
> have their normal icons work properly. The ones that have the problem all
> have that white/blue window icon wherever there is a shortcut to that
> particular program.
>
> I did recently install a security update from the Windows upsate site, but I
> don't think this is when the trouble started.
>
> Thanks for any advise, Todd Mcd
>
>

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

"C:\Program Files\TweakIE 3.1\TweakIE.exe"
"C:\Program Files\Lavasoft\Ad-aware 6\Ad-aware.exe"
"C:\Program Files\Bazooka Spyware Scanner\spywarescanner.exe"
"C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
"C:\Program Files\KaZaA Lite\Kazaa.exe"
"C:\Program Files\Jardinains!\jardinains.exe" C:\Program Files\Jardinains!\

These are several examples. I see that they are all within the "Program
Files" folder. When I open this folder, I don't see any of these programs
there. I'm pretty sure nothing has been deleted or moved, though.

Thanks again, Todd Mcd


"glee" <glee29@spamindspring.com> wrote in message
newsGf9wooeFHA.3848@TK2MSFTNGP10.phx.gbl...
> For troubleshooting, choose one of those non-working shortcuts that have
the generic
> Windows icon: right-click the icon, click Properties on the menu that
appears, and
> look on the Shortcut tab. In the Target line, what is the path? You can
copy and
> paste the path from that line, into a reply to this message. The path
will name the
> folder and file the shortcut is *supposed* to be pointing
to.....apparently it is
> not there, and we need to determine if it is missing, or just moved, and
why.
> --
> Glen Ventura, MS MVP Shell/User, A+
> http://dts-l.org/goodpost.htm
>
>
> "Mcd" <jmcderm3@tampabay.rr.com> wrote in message
> newsaibJNoeFHA.3712@TK2MSFTNGP12.phx.gbl...
> > Seemingly all of a sudden, I cannot locate or run a lot of programs I've
> > installed. When I try to open, I get that box that has what looks like a
> > flashlight searching, and says missing shortcut. On all the programs
that
> > this happens on, the icon for the program has changed to a white box
with a
> > blue border on top (I think this is normally how program icons look in
> > DOS!?)
> >
> > It's as if I've lost a hole lot of shortcuts. All the programs that
still
> > have their normal icons work properly. The ones that have the problem
all
> > have that white/blue window icon wherever there is a shortcut to that
> > particular program.
> >
> > I did recently install a security update from the Windows upsate site,
but I
> > don't think this is when the trouble started.
> >
> > Thanks for any advise, Todd Mcd
> >
> >
>

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

The number of anti-malware apps that are among the missing makes me wonder if some
spyware or trojan is at the source of the disappearances. If I am reading your
reply correctly, you are saying that you had all the listed programs installed, and
now the files and folders are all gone, and you did not uninstall them....correct?

You might want to start off by reinstalling those anti-spyware apps and checking
your system with them, from Safe Mode.

If it is not a malware issue, and you are sure that no one else has uninstalled or
deleted the missing programs, you should check the integrity of the drive, using the
drive manufacturer's diagnostic bootdisk maker to make a bootable floppy for testing
the hard drive.

Try cleaning your system of trojans with the standalone app Sysclean:
- Create a new folder on your Desktop or the C: drive and name it Sysclean.
- Go here and download sysclean.com and the pattern files to the Sysclean folder:
http://www.trendmicro.com/download/dcs.asp
http://www.trendmicro.com/download/pattern.asp
- Unzip the pattern files from their .zip file into the Sysclean folder.
- Restart your computer in Safe Mode.
- Go to the Sysclean folder and double-click sysclean.com to start the scan.

When the scan is finished, use Notepad or Wordpad to look at the log it created. You
may need to locate the files it named there to manually delete them, if sysclean did
not delete them itself.

Following that, while still in Safe Mode, use your anti-virus app to run a
full-system virus scan. Make sure you have already updated it while you are in
normal mode.

Download these apps, install and update them while in normal mode, then run them in
Safe Mode:

CWShredder, the CoolWeb removal tool, available here:
http://www.majorgeeks.com/download3019.html
http://aumha.org/downloads/cwshredder.zip
Close all browser windows and open apps, start CWShredder and click the Fix button.

Ad-Aware SE free Personal Edition (To update it, start it and click its 'Check for
Updates' link in the app to install updates). Use it to scan your system, and
remove what it finds.
Ad-Aware SE personal edition:
http://www.lavasoftusa.com/support/download/
http://www.majorgeeks.com/download506.html

Install, update and run SpyBot Search & Destroy, scan your system, and then remove
the items in RED only.
SpyBot S&D:
http://www.safer-networking.org/in [...] e=download

When removing spyware, it is a good idea to download and store LSPFix ahead of time,
in case you need to fix your Internet connectivity when done. Some spyware will
break your ability to connect when removed.
LSPFix:
http://www.spychecker.com/program/lspfix.html
http://www.cexx.org/lspfix.htm
http://www.snapfiles.com/get/lspfix.html

If problems persist, download, unzip, and run Hijack This from one of these
locations:
http://www.majorgeeks.com/download3155.html
http://computercops.biz/downloads-cat-14.html
http://www.spywareinfo.com/downloa [...] ckThis.exe
Unzip to a folder other than your Desktop or the Temp folder, doubleclick
HijackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button.
Press that, save the log somewhere you can find it (Desktop, My Documents, or
similar).
Most of what it lists will be harmless or even required, so do NOT fix anything yet.

Copy the log files and paste them into a new post at ONE of these forums:
http://forum.aumha.org/viewforum.php?f=30
http://forums.spywareinfo.com/,
http://castlecops.com/forum67.html

In your post, please state your problem clearly and what you've done so far to fix
it.

The folks there will tell you what to remove.

See the "housekeeping" you should complete before you post your log:
http://aumha.org/forum/viewtopic.php?t=4075

A tutorial for using Hijack This is located here:
http://tomcoyote.com/hjt/
--
Glen Ventura, MS MVP Shell/User, A+
http://dts-l.org/goodpost.htm


"Mcd" <jmcderm3@tampabay.rr.com> wrote in message
news:uxGV2VpeFHA.1036@tk2msftngp13.phx.gbl...
> "C:\Program Files\TweakIE 3.1\TweakIE.exe"
> "C:\Program Files\Lavasoft\Ad-aware 6\Ad-aware.exe"
> "C:\Program Files\Bazooka Spyware Scanner\spywarescanner.exe"
> "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
> "C:\Program Files\KaZaA Lite\Kazaa.exe"
> "C:\Program Files\Jardinains!\jardinains.exe" C:\Program Files\Jardinains!\
>
> These are several examples. I see that they are all within the "Program
> Files" folder. When I open this folder, I don't see any of these programs
> there. I'm pretty sure nothing has been deleted or moved, though.
>
> Thanks again, Todd Mcd
>
>
> "glee" <glee29@spamindspring.com> wrote in message
> newsGf9wooeFHA.3848@TK2MSFTNGP10.phx.gbl...
> > For troubleshooting, choose one of those non-working shortcuts that have
> the generic
> > Windows icon: right-click the icon, click Properties on the menu that
> appears, and
> > look on the Shortcut tab. In the Target line, what is the path? You can
> copy and
> > paste the path from that line, into a reply to this message. The path
> will name the
> > folder and file the shortcut is *supposed* to be pointing
> to.....apparently it is
> > not there, and we need to determine if it is missing, or just moved, and
> why.
> > --
> > Glen Ventura, MS MVP Shell/User, A+
> > http://dts-l.org/goodpost.htm
> >
> >
> > "Mcd" <jmcderm3@tampabay.rr.com> wrote in message
> > newsaibJNoeFHA.3712@TK2MSFTNGP12.phx.gbl...
> > > Seemingly all of a sudden, I cannot locate or run a lot of programs I've
> > > installed. When I try to open, I get that box that has what looks like a
> > > flashlight searching, and says missing shortcut. On all the programs
> that
> > > this happens on, the icon for the program has changed to a white box
> with a
> > > blue border on top (I think this is normally how program icons look in
> > > DOS!?)
> > >
> > > It's as if I've lost a hole lot of shortcuts. All the programs that
> still
> > > have their normal icons work properly. The ones that have the problem
> all
> > > have that white/blue window icon wherever there is a shortcut to that
> > > particular program.
> > >
> > > I did recently install a security update from the Windows upsate site,
> but I
> > > don't think this is when the trouble started.
> > >
> > > Thanks for any advise, Todd Mcd
> > >
> > >
> >
>
>

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

Ummm... I'm going to butt in here, assuming that Glen won't mind.

You don't "see" them... Look in Folder Options, View tab and make sure
that "Show All Files" is enabled. If it isn't, it should be. See if that
makes them show up. If it's already set to Show All Files, then they've
either been deleted OR a super-attack known as a Rootkit may be
involved--though it would be the first time I've heard of a rootkit
being used this way.

Basically, if those files are not visible with "Show All Files" enabled
(and make sure to use Find to look for them, in case they've been
moved), then one of three things happened:

1. You accidentally deleted those files. Possible but not likely--maybe
a slip if the click when searching for something? A scan for malware
that went awry?

2. Some "natural" corruption occurred to delete those files. Again,
possible, but not likely to have been so precisely selective as to only
delete those particular classes of executables. Look around--is it only
executables for anti-malware apps that have disappeared?

3. Some malware is mounting a sneak attack by disabling your protective
apps. Could have Hidden the EXEs, could have moved them *and* hidden
them, or could have used Rootkit technology to mess with them, though
rootkits typically use the technology to hide *themselves*, not other
apps.)

Rootkit detection and repair is a relatively new field. For more info,
Google it, and check out Bryce Cogswell and Mark Russinovich's
SysInternals.com pages on the topic at:
http://www.sysinternals.com/utilit [...] ealer.html

I can't immediately find info as to whether RootKitRevealer works on 9x
systems, but I'll find out and post back ASAP. It's still in its infancy
stages, and the last version I DLed had a couple of annoying bugs. They
say it's been fixed, so I'm going to run it and then check with the
folks in the know.

--
Gary S. Terhune
MS MVP Shell/User
http://www.grystmill.com/articles/cleanboot.htm
http://www.grystmill.com/articles/security.htm

"Mcd" <jmcderm3@tampabay.rr.com> wrote in message
news:uxGV2VpeFHA.1036@tk2msftngp13.phx.gbl...
> "C:\Program Files\TweakIE 3.1\TweakIE.exe"
> "C:\Program Files\Lavasoft\Ad-aware 6\Ad-aware.exe"
> "C:\Program Files\Bazooka Spyware Scanner\spywarescanner.exe"
> "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
> "C:\Program Files\KaZaA Lite\Kazaa.exe"
> "C:\Program Files\Jardinains!\jardinains.exe" C:\Program
> Files\Jardinains!\
>
> These are several examples. I see that they are all within the
> "Program
> Files" folder. When I open this folder, I don't see any of these
> programs
> there. I'm pretty sure nothing has been deleted or moved, though.
>
> Thanks again, Todd Mcd
>
>
> "glee" <glee29@spamindspring.com> wrote in message
> newsGf9wooeFHA.3848@TK2MSFTNGP10.phx.gbl...
>> For troubleshooting, choose one of those non-working shortcuts that
>> have
> the generic
>> Windows icon: right-click the icon, click Properties on the menu
>> that
> appears, and
>> look on the Shortcut tab. In the Target line, what is the path? You
>> can
> copy and
>> paste the path from that line, into a reply to this message. The
>> path
> will name the
>> folder and file the shortcut is *supposed* to be pointing
> to.....apparently it is
>> not there, and we need to determine if it is missing, or just moved,
>> and
> why.
>> --
>> Glen Ventura, MS MVP Shell/User, A+
>> http://dts-l.org/goodpost.htm
>>
>>
>> "Mcd" <jmcderm3@tampabay.rr.com> wrote in message
>> newsaibJNoeFHA.3712@TK2MSFTNGP12.phx.gbl...
>> > Seemingly all of a sudden, I cannot locate or run a lot of programs
>> > I've
>> > installed. When I try to open, I get that box that has what looks
>> > like a
>> > flashlight searching, and says missing shortcut. On all the
>> > programs
> that
>> > this happens on, the icon for the program has changed to a white
>> > box
> with a
>> > blue border on top (I think this is normally how program icons look
>> > in
>> > DOS!?)
>> >
>> > It's as if I've lost a hole lot of shortcuts. All the programs that
> still
>> > have their normal icons work properly. The ones that have the
>> > problem
> all
>> > have that white/blue window icon wherever there is a shortcut to
>> > that
>> > particular program.
>> >
>> > I did recently install a security update from the Windows upsate
>> > site,
> but I
>> > don't think this is when the trouble started.
>> >
>> > Thanks for any advise, Todd Mcd
>> >
>> >
>>
>
>

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

"Gary S. Terhune" <grystnews@mvps.org> wrote in message
news:uX4$nJteFHA.3280@TK2MSFTNGP09.phx.gbl...
> snip
> Rootkit detection and repair is a relatively new field. For more info,
> Google it, and check out Bryce Cogswell and Mark Russinovich's
> SysInternals.com pages on the topic at:
> http://www.sysinternals.com/utilit [...] ealer.html
>
> I can't immediately find info as to whether RootKitRevealer works on 9x
> systems, but I'll find out and post back ASAP.

Nope, RootKitRevealer does not work for Win9x.
--
Glen Ventura, MS MVP Shell/User, A+
http://dts-l.org/goodpost.htm

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

darnit!

Of course, there's the question of whether rootkits work on 9x, but I
don't see why not.

It seems that the most common end-result of a rootkit invasion is to
flatten the system and start over.

--
Gary S. Terhune
MS MVP Shell/User
http://www.grystmill.com/articles/cleanboot.htm
http://www.grystmill.com/articles/security.htm

"glee" <glee29@spamindspring.com> wrote in message
news:udrZcWteFHA.2076@TK2MSFTNGP15.phx.gbl...
> "Gary S. Terhune" <grystnews@mvps.org> wrote in message
> news:uX4$nJteFHA.3280@TK2MSFTNGP09.phx.gbl...
>> snip
>> Rootkit detection and repair is a relatively new field. For more
>> info,
>> Google it, and check out Bryce Cogswell and Mark Russinovich's
>> SysInternals.com pages on the topic at:
>> http://www.sysinternals.com/utilit [...] ealer.html
>>
>> I can't immediately find info as to whether RootKitRevealer works on
>> 9x
>> systems, but I'll find out and post back ASAP.
>
> Nope, RootKitRevealer does not work for Win9x.
> --
> Glen Ventura, MS MVP Shell/User, A+
> http://dts-l.org/goodpost.htm
>
>

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

"Gary S. Terhune" <grystnews@mvps.org> wrote in message
news:%23nF4elueFHA.688@TK2MSFTNGP14.phx.gbl...
> darnit!
>
> Of course, there's the question of whether rootkits work on 9x, but I
> don't see why not.

I'm not sure, but what googling I have done on it indicates that Win9x is vulnerable
to some rootkits.


> It seems that the most common end-result of a rootkit invasion is to
> flatten the system and start over.

I have not had to remove any yet, so I can only go by those MVPs and others working
in the appropriate forums; from what I have seen, they have been fairly successful
in ridding systems of rootkits without flattening them. It requires a lot of
persistence and special tools, and is not something for Joe User to attempt without
help and guidance. For corporate systems, flattening and restoring an image is the
smart way to go, but home systems not so much, IMVHO.
--
Glen Ventura, MS MVP Shell/User, A+
http://dts-l.org/goodpost.htm
http://www.microsoft.com/communiti [...] fault.mspx


> "glee" <glee29@spamindspring.com> wrote in message
> news:udrZcWteFHA.2076@TK2MSFTNGP15.phx.gbl...
> > "Gary S. Terhune" <grystnews@mvps.org> wrote in message
> > news:uX4$nJteFHA.3280@TK2MSFTNGP09.phx.gbl...
> >> snip
> >> Rootkit detection and repair is a relatively new field. For more
> >> info,
> >> Google it, and check out Bryce Cogswell and Mark Russinovich's
> >> SysInternals.com pages on the topic at:
> >> http://www.sysinternals.com/utilit [...] ealer.html
> >>
> >> I can't immediately find info as to whether RootKitRevealer works on
> >> 9x
> >> systems, but I'll find out and post back ASAP.
> >
> > Nope, RootKitRevealer does not work for Win9x.
> > --
> > Glen Ventura, MS MVP Shell/User, A+
> > http://dts-l.org/goodpost.htm
> >
> >
>