Need Ideas.. problem w/WinME

[Jeradln82]

Okie dokie, I have a coworkers computer here in front of me. Its an old gateway running Windows ME. He had a load of spyware and other junk on this sucker that was keeping him from doing pretty much anything. I got it all cleaned up except one thing. I keep getting this error:

Explorer has caused an error in
~70828088388.temp
Exporer will now close

If I hit close I can no longer use the PC. It will stay on, but nothing I click will work. The start button, icons, and taskbar will disappear. I am unable to update his anti-virus b/c I have no way of connecting it to the internet, IE will not open.


I've went into safemode and deleted the file, but it then just gets replaced again, so that didn't work. Also, I get no error in safemode unless I try to open IE, then it will say the same thing, but instead of having the name of a file it says <unknown> So it looks like:

Explorer has caused an error in <unknown>
Exporer will now close

If I hit close in safemode everything else is fine.


I looked in the Microsoft Knowledge base and found nothing on the file mentioned.

If I just leave the error box open on the desktop I can cruse the PC just fine, just like nothing was wrong. But once I close the box I loose all the stuff and cannot do anything.

If anyone has any ideas, feel free to shoot them at me. I'm stumped here as to what I can do. I'm thinking about the last resort Reformat, but I really don't want to do that if I don't have to.

Thanks ya'll.


p.s. I love the new site layout. ;)

[andyms18a]

first thing i wood do is run msconfig and stop all startup items then delete the file reboot and see if its back if it is run regedit and search for a refrence to the file and see wot it says you my be abble to remove it if your not shore then post wot the reg says hear

[GaryRouth]

I like andy's ideas for checking in msconfig for suspicious processes, and for rooting references out in the Registry.

It sounds like you might have several computers at your disposal: if the problem continues to be difficult to fix even after trying those fixes, you also have the option of slaving the drive in another computer. You'd want the extra "Helper PC" to have up-to-date antivirus/antispyware. Since none of it's files are involved in the system startup (while slaved in the Helper PC), you have a better shot at detecting and removing them.

Just before you slave the drive, you probably will want to disable System Restore. It can help to delete the restore folder while the drive is slaved in the Helper PC, since it's likely that it's infected. Performing a System Restore with an infected folder restores the viruses & trojans, too! But if you delete the folder while System Restore is Disabled, and the drive is slaved in the Helper PC, Windows will re-create a clean Restore folder when you re-enable System Restore when your repairs are finished & you're certain the drive is virus/spyware free. Using online scanners as a double-check for viruses/spyware can be handy for this sort of thing: just before you turn System Restore back on, try a visit to http://housecall.trendmicro.com [there are other fine online scanners besides HouseCall - Panda is another, and both McAfee and Symantec I think are now providing online scans]
. . . Gary

[ . . .& Hi again, andy! I've got to build three systems, fix the backyard sprinklers, and work double shifts Saturday & Sunday - but other than that: it's all leisure time around here :) ]

[tacoeater]

gary,
i liked your info about deleting the system restore when the drive is slaved. thanks for the idea.
alan

[GaryRouth]

Just another quick note:

There is also a way to safely delete & recreate the folder in DOS when a helper PC isn't available [since the folder is a hidden, system folder - a few attribute changes make things simpler]. This is a good routine when your regular antivirus has cleaned the virus from all folders, but can't clean the Restore folder. [Actually, such dormant viruses shouldn't hurt unless a Restore is run, and they do eventually get dumped by the system (as newer, clean restore points are created) - but I like to start fresh, even if it makes me sound like a soap commercial]

Boot to DOS using either your bootable WinME CD "start computer with CD support", or a bootable WinMe floppy diskette [they have one at http://www.bootdisk.com], and enter these commands from the A: prompt

ATTRIB -R -H -S C:\_RESTORE
REN C:\_RESTORE OLDREST

Then take your CD or floppy diskette out, and boot into WinMe normally. You should now have one, clean, restore point. You can then delete the C: \OLDREST folder from Windows Explorer. [what the whole thing does is change the folder to it isn't a hidden or a protected system folder anymore, then lets you Rename it - so you can easily delete it later]

I first learned this one from a couple knowledgeable techs over at experts-exchange.
. . . Gary