Upgrade Windows

Topic

New Reply

hi
I need some advise here. Currently im running Win98 and now looks like my pc need some upgrade. Im not sure which Windows should i choose to upgrade. I have also upgrade to IE6 and when i run the internet it seems like very slow and always hang. What do you think of this situation? It is necessary to upgrade my win98 ? Which Window should i choose to upgrade.? WinXP or Win2K?

Reply | Quote

Replies

Sorry for the late reply.
Currently im using pentium3

Reply | Quote

Sorry for the late reply.
Currently im using pentium3

Reply | Quote

Hi nuglorious !!

[indent]

---

I do NOT recommend that you install the optional updates (I’ll shoot Windows Update if it tries to stick Internet Explorer 6 on my Windows 98 system again).

---

[/indent]

This quote is from Woody’s Windows Watch #8.36 and would appear to indicate that your problems are due to the upgrade to IE6. I had heard that there were issues with Win98 and IE 6 but it seems that Woody himself doesn’t like the combination and that is the best recommendation I know of to avoid it at ALL costs. You might be able to reinstall Windows 98 over itself and get back IE 5 in the process, but I’m not sure. You may have to resort to a clean install of Windows to rid yourself of the IE6 install. If you plan on upgrading Windows itself, you should go right to XP if your system will handle it. Sounds like it will, but just barely. I’d attempt to fix your current install before you consider an upgrade. But that’s just a personal observation.

Reply | Quote

Hi Doc,
I guess you are correct. I heard yr advise. thks.
Currently my pc running Win98 w IE6. I felt tht my pc running quite slow during browsing the internet. Maybe i hv upgrade the IE to IE6 which is not really suitable with Win98. But I already upgraded before hand. Hopefully nothing happen…

Reply | Quote

Hi Doc,
I guess you are correct. I heard yr advise. thks.
Currently my pc running Win98 w IE6. I felt tht my pc running quite slow during browsing the internet. Maybe i hv upgrade the IE to IE6 which is not really suitable with Win98. But I already upgraded before hand. Hopefully nothing happen…

Reply | Quote

Doc,
I am not sure if this is the correct place for this post or how many questions to ask at one time. Also, I am not computer wiz. Not by a long shot. Most of my time on the computer is spent going through e-mail from the 12 hobby lists I subscribe to. I recently replaced a Cannon BJ4100 series printer with a HP psc 2110 all-in-one printer-scanner-copier.
Hardware and Software are as follows;
Compaq 7470
AMD-K36 3D Processor at 533 MHz
64 MB RAM with 128 RAM added (184 RAM total)
50% System Resources free
Windows managed swap file on C drive (13288 MB free)
Available on C drive 13288 MB of 16277 MB (FAT 32)
Available on D drive 1653 MB of 2792 MB (FAT 32)
Win-98 4.10
IE 5 6.0
McAfee;
Virus Scan 8.0
Engine Version 4.2.60
Dat Version 4.0.4292
Dat Created 9-10-03
Firewall v4.5
Version 4.5.2.30

As you must know, McAfee is having problems that to my knowledge are not corrected and may very well be complicating my problems. Some of my problems are;
-Freeze when shutting down. Have tried Ctrl-Alt-Del with some success. Usually necessary to power-down with on/off button.
-Freeze during reboot shortly after desktop Icons appear. Must power-down with on/off button. Have done this as many as 3 times before a complete reboot.
-IE will stop responding during send/receive process. This did not happen before McAfee’s recent problems.
-The troubleshooting utility and Compaq Built-In Technician do not function.

I will stop here for now and ask if this info is what is needed for diagnostics? And, would this be better posted to another area of the Lounge?

Mick Weis – FLH rider

Reply | Quote

Hi Mick:
I would post these in this fourm (Win 98) but start a new thread with an appropriate subject. You are more likely to get answers that way.
Cheers,

Reply | Quote

Hi Mick:
I would post these in this fourm (Win 98) but start a new thread with an appropriate subject. You are more likely to get answers that way.
Cheers,

Reply | Quote

Mornin’ Mick,

You seem to be in need of the Windows 98SE shutdown patch. This has been a known issue with Windows 98 machines for some time now. go here and read up on it (since you’re “not a computer wiz”). It will help you understand the problem and the process of downloading and installing the patch. The “Next” button on the Licence Agreement page will initiate the download. HTH.

If this doesn’t do the trick, post back and we’ll go down a different path. It could be McAfee, but let’s look “in house” before going out looking for trouble.

Reply | Quote

Thanks to Doc and Phil for there input. I have down loaded the Shutdown Patch per Doc’s suggestion. I’ll see how things work out for a few days and will ask more questions as necessary.

Mick Weis FLH Rider

Reply | Quote

Thanks to Doc and Phil for there input. I have down loaded the Shutdown Patch per Doc’s suggestion. I’ll see how things work out for a few days and will ask more questions as necessary.

Mick Weis FLH Rider

Reply | Quote

Still having shutdown trouble despite downloading Windows 98SE shutdown patch per the suggestion by Doc.
For example, I tried to shutdown today with the following result.
-First I closed all open programs on the toolbar; Outlook Express, Mcafee (scan on line and firewall),
HP (printer-scanner-copier) and paused Task Scheduler.
-Pressed Ctrl-Alt-Delete (once) to look at Close Program window to see if there were any programs
(not responding).
The following programs were (still) running;
Explorer
Mpftray
Mpfagent
Mcvsrte
Mcvsescn
Hpotdd01
Systray
Ptsnoop
Realevent
Rnaapp
-Clicked Cancel in the Close Program window
-Click Start, click Ok (for shutdown).
-PC made some processing noises and the screen went blank with Windows green wall to wall.
I waited for a minute. Nothing happened.
-Pressed Ctrl-Alt-Delete twice and got a blue screen
-Pressed the space bar and got the Close Program window with the following list of items;
Hpotdd01
Systray
Tapisry
Rundll 32 (Not Responding)
-Clicked End Task
Got a black (dark gray) screen
Waited . . . . nothing.
-Pressed Ctrl-Alt-Delete twice
Got the black screen
-Pressed Ctrl-Alt-Delete twice
Blue screen
-Pressed space bar and got the Close Program window with the following list of items;
Mstask (Not Responding)
Hpotdd01
Systray
-Clicked End Task
Got a black screen
Pressed Ctrl-Alt-Delete twice
Blue screen
-Pressed space bar and got the Close Program window with the following list of items;
Hpotdd01
Systray
Spool 32 (Not Responding)
At this point it was necessary to press (and hold) the On/Off button to shut down.

The PC will reboot (after it does the “not shut down properly” scan)
The following items are Checked in the startup list;
CountrySelection
PTSnoop
StstemTray
MCUpdate
MCAgent
TkBellExe
SchedulingAgent
hpoddt01
hp instant support
hp psc 2000 series

I need more help.

Reply | Quote

Mick,

A couple of thing here caught my attention. The Spool 32 (not responding) error would seem to indicate that ther is something in the printer que waiting to be printed. Is there ?? I’m guessing that the HP lines are referring to a printer. You might want to try removing the printer and letting Windows find and install it on a reboot. Be sure you have the drivers or installation disk for the printer before you try this, as it appears to be newer than the OS.

“The following items are Checked in the startup list;
CountrySelection what’s this for??
PTSnoop what is this??
StstemTray
MCUpdate
MCAgent
TkBellExe And This??
SchedulingAgent
hpoddt01 this?
hp instant support
hp psc 2000 series

I’ll check out those processes and see if I can determint what they do. If you already know, and feel they are all necessary and normal functions, please advise. That ” Hpotdd01″ entry is troublesome and may have something to do with the issue.

Reply | Quote

Mick,

A couple of thing here caught my attention. The Spool 32 (not responding) error would seem to indicate that ther is something in the printer que waiting to be printed. Is there ?? I’m guessing that the HP lines are referring to a printer. You might want to try removing the printer and letting Windows find and install it on a reboot. Be sure you have the drivers or installation disk for the printer before you try this, as it appears to be newer than the OS.

“The following items are Checked in the startup list;
CountrySelection what’s this for??
PTSnoop what is this??
StstemTray
MCUpdate
MCAgent
TkBellExe And This??
SchedulingAgent
hpoddt01 this?
hp instant support
hp psc 2000 series

I’ll check out those processes and see if I can determint what they do. If you already know, and feel they are all necessary and normal functions, please advise. That ” Hpotdd01″ entry is troublesome and may have something to do with the issue.

Reply | Quote

Mick,

Check out this information on PTsnoop and see how it applies to your particular situation. There seem to be several interpritations of the file (modem drivers or backdoor TROJAN !!!)

http://www.sophos.com/virusinfo/analyses/trojptsnoop.html%5B/url%5D Read this first.

http://www.f-secure.com/v-descs/ptsnoop.shtml%5B/url%5D

http://www.computing.net/windows95/wwwboar…rum/146843.html%5B/url%5D

Although ptsnoop can be spyware or backdoor trojan horse, in my case, it proved to be a legit file (ptsnoop.exe), which is on the drivers I used to install a modem (PCTEL) which I robbed out of my 98SE computer

I also took a look at the win.ini file and there was no ptsnoop.exe (if it were the backdoor virus it would have been) in it anywhere

You may want to try the following:

1. Click Start and choose Run.
2. Type SYSEDIT and click OK. The System Configuration Editor opens.
3. Click the WIN.INI title bar.
4. In the LOAD= line, you will see PTSNOOP.EXE. Place a colon in front of this line. For example:

;LOAD=PTSNOOP.EXE

Save changes.

Now click Start>Run and type Msconfig.

Click on the Startup tab and uncheck Ptsnoop

Now click Start>Run and type Regedit.

Go to the following key:

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun

If you see any reference to Ptsnoop.exe in the right hand pane, delete it, close Regedit and reboot.

I’m goin after TkBellExe next !!! [

Reply | Quote

I’m a little slow at this computer stuff, Doc. It will take a day or two for me to sort through your suggestions. And there is one thing for sure. I don’t know what those items are either.

Reply | Quote

Take your time, and if you have questions or problems along the way, post back and we’ll try to sort through them. We are here to help.

First go to StartRun and type msconfig then hit enter and in the resulting window uncheck that “Tinkerbell” item (the one for RealPlayer) and reboot. See if that does it.

Reply | Quote

Doc . . . Per your notes;
I have nothing pending for the printer. (hpoddt01)
Unchecked TkBellExe on the start-up menu.
Updated my Adaware, ran a scan and found these;

ArchiveData(auto-quarantine- 22-09-2003 13-34-26.bckp)
============================================
WINDOWS

Reply | Quote

Mick,
First off, I’d leave those 2 items AdAware found, alone.
obj[0]=RegData : .DEFAULTSoftwareMicrosoftMediaPlayerPlayerSettings
obj[1]=RegData : SoftwareMicrosoftMediaPlayerPlayerSettings
They appear to be registry settings for Windows Media Player. I’m not sure if they are a problem or not. You can tell AdAware to ignore them for now and if they are a problem you can always delete them later. Perhaps another lounger can help out here. Anyone ????
The Tracking Cookie from Gator is something you REALLY DON”T WANT. Let AdAware get rid of it !!!

The PTSnoop workaround is someone elses, not mine. I’m fairly certain that they meant “Semi-colon” but as we aren’t sure it’s best left alone for now. Again, you can uncheck PTSnoop on the startup menu and reboot. Then do a Control/Alt/Delete and see if it’s running.

One other question I should have asked earlier: Are you having a problem with rebooting or just shutdown ???

Reply | Quote

Doc,
I did the Uncheck PTSnoop and reboot twice. Both times the Check was back in place when I used Ctrl/Alt/Delete to see what was going on. What’s next?
As far as trouble with rebooting, right now I do not have a problem with that end of things. I will say this though. When the McAfee automatic update issues began I did have trouble with rebooting. I have been following that end of things on a McAfee help site but have not checked in there for 3 days. At present I have the automatic update feature disabled and all McAfee items in the start menu are unchecked.

Reply | Quote

Mornin’ Again Mick !!

It appears that we are narrowing the field now. I suspected that it would regenerate itself when Windows restarted. Did you check out the websites in the links that I posted ??? They explain this behavior. I think what you have is the backdoor Trojan variation of this file. Here is the information from 2 of those links. Compare what’s going on with your system to this info and if you decide to remove it as a Trojan, be aware that it could be a file that your Modem may need and removing it will trash you modem settings and you may have to reinstall the modem software. I can’t determine from here if it has to do with your modem or not. You’ll have to make that call. If you don’t trust your McAffe setup you could get the system scanned online at McAffe or another FREE online scan site.

From the F-Secure site………………..
NAME: Ptsnoop
ALIAS: Backdoor.Ptsnoop
Please note that certain software packages for certain modems contain PTSNOOP.EXE files, but these are not trojans. If you are not sure if that file is a trojan or not, use F-Secure Anti-Virus to check it out. This is Doc – Any Anti-Virus will do. It’s an old Trojan
Ptsnoop is a simple backdoor program written in Visual Basic. Being activated it first looks for active RAS connections and exits immediately if none is found.
If a connection is present, the backdoor installs itself to system by copying itself as PTSNOOP.EXE file to WindowsSystem directory and modifying WIN.INI file. The backdoor adds its execution string after LOAD= variable in [Windows] section of WIN.INI file. Diring this operation WIN.INI file gets copied to WIN.ANA file, the backdoor’s execution string is then added and WIN.INI file is deleted. Then WIN.ANA file is renamed to WIN.INI file. This way the backdoor will become active every time Windows starts.
Being active the backdoor tries to connect to the following websites:
http://setway.cjb.net
http://setway1.cjb.net
http://setone.cjb.net
When the connection succeeds, the backdoor clips cursor to a certain area and allows a hacker or script on these websites to control mouse movement and window positions. It is not clear why this is done and it is impossible to check any more because the contents of the above mentioned websites were changed or removed.
In any case, this backdoor should be deleted from a system and WIN.INI file should be cleaned from backdoor’s execution string after LOAD= variable.
[Analysis: Alexey Podrezov; F-Secure Corp.; September 2001]

From the Sophos site………………..
Troj/Ptsnoop is a backdoor Trojan. It copies itself to windowssystemptsnoop.exe and changes win.ini adding ‘c:windowssystemptsnoop.exe’ to ‘load = ‘.
Trojans infect computers, but do not infect files. They can simply be identified and deleted. However, they often make registry or startup file changes so that they are executed on boot-up. Check the virus analysis for details of such behaviour.

Doc again – Run a virus scan from your system installation or get it done online and if it finds the Trojan, follow the steps indicated to remove it. Once it’s removed you may have to edit your Win.ini file. Here’s how………

Editing Win.ini
At the taskbar, click Start|Run and type Sysedit. Bring Win.ini to the front. In the [windows] section, search for a line beginning with ‘load=’ and delete any references to the files you removed (‘c:windowssystemptsnoop.exe’). Delete only that reference, not any other text.
Reboot your computer.

Reply | Quote

Mornin’ Again Mick !!

It appears that we are narrowing the field now. I suspected that it would regenerate itself when Windows restarted. Did you check out the websites in the links that I posted ??? They explain this behavior. I think what you have is the backdoor Trojan variation of this file. Here is the information from 2 of those links. Compare what’s going on with your system to this info and if you decide to remove it as a Trojan, be aware that it could be a file that your Modem may need and removing it will trash you modem settings and you may have to reinstall the modem software. I can’t determine from here if it has to do with your modem or not. You’ll have to make that call. If you don’t trust your McAffe setup you could get the system scanned online at McAffe or another FREE online scan site.

From the F-Secure site………………..
NAME: Ptsnoop
ALIAS: Backdoor.Ptsnoop
Please note that certain software packages for certain modems contain PTSNOOP.EXE files, but these are not trojans. If you are not sure if that file is a trojan or not, use F-Secure Anti-Virus to check it out. This is Doc – Any Anti-Virus will do. It’s an old Trojan
Ptsnoop is a simple backdoor program written in Visual Basic. Being activated it first looks for active RAS connections and exits immediately if none is found.
If a connection is present, the backdoor installs itself to system by copying itself as PTSNOOP.EXE file to WindowsSystem directory and modifying WIN.INI file. The backdoor adds its execution string after LOAD= variable in [Windows] section of WIN.INI file. Diring this operation WIN.INI file gets copied to WIN.ANA file, the backdoor’s execution string is then added and WIN.INI file is deleted. Then WIN.ANA file is renamed to WIN.INI file. This way the backdoor will become active every time Windows starts.
Being active the backdoor tries to connect to the following websites:
http://setway.cjb.net
http://setway1.cjb.net
http://setone.cjb.net
When the connection succeeds, the backdoor clips cursor to a certain area and allows a hacker or script on these websites to control mouse movement and window positions. It is not clear why this is done and it is impossible to check any more because the contents of the above mentioned websites were changed or removed.
In any case, this backdoor should be deleted from a system and WIN.INI file should be cleaned from backdoor’s execution string after LOAD= variable.
[Analysis: Alexey Podrezov; F-Secure Corp.; September 2001]

From the Sophos site………………..
Troj/Ptsnoop is a backdoor Trojan. It copies itself to windowssystemptsnoop.exe and changes win.ini adding ‘c:windowssystemptsnoop.exe’ to ‘load = ‘.
Trojans infect computers, but do not infect files. They can simply be identified and deleted. However, they often make registry or startup file changes so that they are executed on boot-up. Check the virus analysis for details of such behaviour.

Doc again – Run a virus scan from your system installation or get it done online and if it finds the Trojan, follow the steps indicated to remove it. Once it’s removed you may have to edit your Win.ini file. Here’s how………

Editing Win.ini
At the taskbar, click Start|Run and type Sysedit. Bring Win.ini to the front. In the [windows] section, search for a line beginning with ‘load=’ and delete any references to the files you removed (‘c:windowssystemptsnoop.exe’). Delete only that reference, not any other text.
Reboot your computer.

Reply | Quote

Doc,
I was a little nervous about digging into the PTSnoop issue. You wrote that any Virus software should detect this Trojan cuz it an old bug. I just ran my (up to date) McAfee Virus Scan and it found no problems. Can I assume that the PTSnoop on my machine is not a Trojan?
I do not run a virus scan on any particular schedule but do run it several times a month, and more often when I receive an attachment I believe to be infected. I never open attachments from people I do not know. All Spam and other undesirable junk gets packed-up and sent here;
spaminator@mindspring.com ; abuse@mindspring.com ; abuse@abuse.earthlink.net

Reply | Quote

Mick,

Sounds like we’re barking up the wrong tre with the Trojan if an up-to-date McAfee scan didn’t turn it up. One last test to see if it’s part of the modem’s software package. Open Windows Explorer and navigate to C:WindowsSystem and locate the PTsnoop.exe file and rename it to PTsnoop_old.exe. Minimize the window and then try to connect to the internet. If your modem won’t dial out and says it can’t find the file PTsnoop.exe then you’ll know that it’s for the modem. Then simply reopen the window you minimized and change the file name back to it’s original form. Close the window and try your to connect to the internet. If you’re still having problems after this, then we should think about removing your modem and letting Windows reinstall it from bootup. Post back with the results of the name change routine.

Reply | Quote

Doc . . . The machine told me “Can not rename file because it is in use”.
Do I need to use Ctrl/Alt/Delete and End Task to turn off PTsnoop before I can rename it? If so, what then?

Reply | Quote

Mick,

You could try that . If the machine lets you, then see if you can get online. If not, then we can be pretty certain that it’s for the modem. If you speak DOS (and I don’t, at least not well) you can rename it from a command prompt, but that’s probably not worth the trouble. Easier just to remove the modem in Device Manager and then reboot and let Windows find it and install it. But just in case, make sure you have the drivers for it on a disk or the install software to do the reinstall manually before you uninstall it. Better safe than sorry !!

Reply | Quote

Doc,
First I appreciate your patience. Oh, the horrors of unskilled labor.
This is what I did to rename Ptsnoop.
Rebooted. Used Ctrl/Alt/Del to bring up the Close Program window, high
lighted Ptsnoop and clicked End Task. Went to C:WindowsSystem to find
Ptsnoop but it is not there, it’s in C:Windows. Per your instructions I
renamed Ptsnoop.exe to Ptsnoop_old.exe minimized the window and tried to
connect. Had no trouble connecting. I know the connection was good because
my (McAfee) Firewall detected several pings and I checked my E-mail (Outlook
Express). I again looked at the Close Program window to see if Ptsnoop was
there and it was not.
Before closing C:Windows I changed the name back to Ptsnoop.exe.
When I was in the process of putting this info together to post to the
Lounge, my machine froze. I hit Ctrl/Alt/Del to try and back out but was
awarded a Blue Screen. I hit the space bar and the screen went black. It was
necessary to push On/Off button.
I had no trouble rebooting after the “Did not shut down properly scan”.
Oops, I forgot to include the following;
It would seem that in my case Ptsnoop is not part of the modem. Which leads me to ask why didn’t my McAfee virus scan or Adaware find it. And, should I get rid of it and how?

Reply | Quote

Hey Mick,

Persistence pays off sometimes. And if you’re not persistent you’ll never be patient. Or is it the other way around ??? Better leave the philosophy to the philosophers !!!

I can’t explain why your McAfee and AdAware are not picking up the PCsnoop file, but that’s not as important as the fact that your system appears to function better without that file in the mix. I’d suggest that you go back to C: Windows (unusual that it’s there when all the documentation says it should be in C:WindowsSystem) and rename the file again. Follow your previous steps (good thinking, by the way ) and then test your internet connection again. If all is working well, leave the file renamed as is and reboot your system. If it boots normally (and I have no reason to think that it won’t), do a Ctrl/Alt/Delete and make sure it’s not running. If it’s not, then see if the system is running as it should. If all seems normal for a week or so and you’ve at least opened and checked the functionality of all your programs and utilities then we can consider purging the registry of all references to that nasty piece of business and deleting the file entirely.

I’ve got my !! Let me know how you make out. BTW – We were ALL unskilled at some point !!!

Reply | Quote

Doc,
I’m glad the Ptsnoop thing is working out . . . so far. I still don’t see
“it” on the Close Program (Window) list. Fooling around with things I don’t
understand makes me a little uneasy. I am much handier with nuts, bolts,
cams, levers, gears . . . etc.
Per your suggestion, I will again rename the Ptsnoop file (late this
evening), reboot and run. If all goes well I’ll request removal
instructions.
I have more questions but will give you a day or two to rest-up.

Reply | Quote

Mick,

One last thing…….. before you reboot the computer after renaming PCsnoop, go to StartRun and type msconfig and uncheck the PCSnoop entry. That way the system won’t look for it when it starts and you won’t get an error if it wants it to start and it’s not there (when you renamed it you in effect made it something else as far as the computer is concerned). Then reboot and that should take care of PCsnoop.

When we get you computer all straightened out, I’ve got a couple questions about my car that you might be able to help me with. Just kiddin’ !!! If we get your system straightend out, that’s it’s own reward. Keep me posted.

Reply | Quote

Doc,
There may be a glitch here. I took the time to uncheck Ptsnoop in the start
menu. Renamed the file to Ptsnoop_old.exe and rebooted.
I looked at the start menu after the reboot and Ptsnoop was checked. I
looked at the Close Program menu and there is no Ptsnoop there. I went
through the uncheck (Ptsnoop) and reboot 3 times and each time Ptsnoop is
checked in the Start Menu but not present on the Close Program menu.
The PC does not seem to perform any better or worse.
And as far as the shut down issue, well, it seem as though the longer it runs the more difficult it is to shut down.

Reply | Quote

Doc,
There may be a glitch here. I took the time to uncheck Ptsnoop in the start
menu. Renamed the file to Ptsnoop_old.exe and rebooted.
I looked at the start menu after the reboot and Ptsnoop was checked. I
looked at the Close Program menu and there is no Ptsnoop there. I went
through the uncheck (Ptsnoop) and reboot 3 times and each time Ptsnoop is
checked in the Start Menu but not present on the Close Program menu.
The PC does not seem to perform any better or worse.
And as far as the shut down issue, well, it seem as though the longer it runs the more difficult it is to shut down.

Reply | Quote

Mick,

I’m beginning to think that the only thing to do with this issue is either to edit it out of the registry and the Win.ini file completely or just let it alone. The more I read about it, the less I’m sure of. It seems more and more like what you have on your system is something to do with an old PCtel modem. I’m guessing that you didn’t follow those links that I posted or you would have seen how this all compares to your system and what’s going on. Compare this information from those links to what your system has been telling you about this PTsnoop file.

Do you have a modem with the pctel 789 chipset? You may need to open the case and look at the modem.
If you do, then don’t worry about those files. They’re perfectly OK. They’re not causing any problems with your computer.
If you don’t have a modem with the 789 chipset then perhaps you once had one and the drivers weren’t removed when a new modem was installed. Go to add/remove programs in control panel and look for an HSP modem. That’s probably the old modem. Uninstall it. If it turns out the HSP modem is your current modem, you’ll need to reinstall the drivers.
‘Countryselection’ accompanies the modem ptsnoop. The fact it’s also loading means you have the modem ptsnoop and not the virus ptsnoop.

If you still want to remove it after reading that, this is what you will have to do.

1st) go to START RUN and type in REGEDIT once the regedit window pops up go to EDIT FIND and type in PTSNOOP and hit ENTER. Each item that the regedit finds with PTSNOOP in the text it will highlight then all you have to do is hit DELETE, then hit the F3 key to continue searching, do this untill it says FINISHED SEARCHING THROUGH REGISTRY.
2nd) go to START FINDSEARCH and type in PTSNOOP.EXE then hit ENTER. Delete all the files that the search finds.
3RD)Start a new search and type in PCtelMDMCHIPV.INF this is the file that tells the computer to load the PTSNOOP file. Delete it.

Editing Win.ini
At the taskbar, click Start|Run and type Sysedit. Bring Win.ini to the front. In the [windows] section, search for a line beginning with ‘load=’ and delete any references to the files you removed (‘c:windowsptsnoop.exe’). Delete only that reference, not any other text.
Reboot your computer.

I’m beginning to believe that you have more problems than can be worked out in an online forum and that it may be time for a trip to your local PC guru or to backup your data and then format the drive to rid it of it’s demons and then reinstall the OS and start fresh, Let me know what you want to do.

Reply | Quote

Mick,

I’m beginning to think that the only thing to do with this issue is either to edit it out of the registry and the Win.ini file completely or just let it alone. The more I read about it, the less I’m sure of. It seems more and more like what you have on your system is something to do with an old PCtel modem. I’m guessing that you didn’t follow those links that I posted or you would have seen how this all compares to your system and what’s going on. Compare this information from those links to what your system has been telling you about this PTsnoop file.

Do you have a modem with the pctel 789 chipset? You may need to open the case and look at the modem.
If you do, then don’t worry about those files. They’re perfectly OK. They’re not causing any problems with your computer.
If you don’t have a modem with the 789 chipset then perhaps you once had one and the drivers weren’t removed when a new modem was installed. Go to add/remove programs in control panel and look for an HSP modem. That’s probably the old modem. Uninstall it. If it turns out the HSP modem is your current modem, you’ll need to reinstall the drivers.
‘Countryselection’ accompanies the modem ptsnoop. The fact it’s also loading means you have the modem ptsnoop and not the virus ptsnoop.

If you still want to remove it after reading that, this is what you will have to do.

1st) go to START RUN and type in REGEDIT once the regedit window pops up go to EDIT FIND and type in PTSNOOP and hit ENTER. Each item that the regedit finds with PTSNOOP in the text it will highlight then all you have to do is hit DELETE, then hit the F3 key to continue searching, do this untill it says FINISHED SEARCHING THROUGH REGISTRY.
2nd) go to START FINDSEARCH and type in PTSNOOP.EXE then hit ENTER. Delete all the files that the search finds.
3RD)Start a new search and type in PCtelMDMCHIPV.INF this is the file that tells the computer to load the PTSNOOP file. Delete it.

Editing Win.ini
At the taskbar, click Start|Run and type Sysedit. Bring Win.ini to the front. In the [windows] section, search for a line beginning with ‘load=’ and delete any references to the files you removed (‘c:windowsptsnoop.exe’). Delete only that reference, not any other text.
Reboot your computer.

I’m beginning to believe that you have more problems than can be worked out in an online forum and that it may be time for a trip to your local PC guru or to backup your data and then format the drive to rid it of it’s demons and then reinstall the OS and start fresh, Let me know what you want to do.

Reply | Quote

Mick,

One last thing…….. before you reboot the computer after renaming PCsnoop, go to StartRun and type msconfig and uncheck the PCSnoop entry. That way the system won’t look for it when it starts and you won’t get an error if it wants it to start and it’s not there (when you renamed it you in effect made it something else as far as the computer is concerned). Then reboot and that should take care of PCsnoop.

When we get you computer all straightened out, I’ve got a couple questions about my car that you might be able to help me with. Just kiddin’ !!! If we get your system straightend out, that’s it’s own reward. Keep me posted.

Reply | Quote

Doc,
I’m glad the Ptsnoop thing is working out . . . so far. I still don’t see
“it” on the Close Program (Window) list. Fooling around with things I don’t
understand makes me a little uneasy. I am much handier with nuts, bolts,
cams, levers, gears . . . etc.
Per your suggestion, I will again rename the Ptsnoop file (late this
evening), reboot and run. If all goes well I’ll request removal
instructions.
I have more questions but will give you a day or two to rest-up.

Reply | Quote

Hey Mick,

Persistence pays off sometimes. And if you’re not persistent you’ll never be patient. Or is it the other way around ??? Better leave the philosophy to the philosophers !!!

I can’t explain why your McAfee and AdAware are not picking up the PCsnoop file, but that’s not as important as the fact that your system appears to function better without that file in the mix. I’d suggest that you go back to C: Windows (unusual that it’s there when all the documentation says it should be in C:WindowsSystem) and rename the file again. Follow your previous steps (good thinking, by the way ) and then test your internet connection again. If all is working well, leave the file renamed as is and reboot your system. If it boots normally (and I have no reason to think that it won’t), do a Ctrl/Alt/Delete and make sure it’s not running. If it’s not, then see if the system is running as it should. If all seems normal for a week or so and you’ve at least opened and checked the functionality of all your programs and utilities then we can consider purging the registry of all references to that nasty piece of business and deleting the file entirely.

I’ve got my !! Let me know how you make out. BTW – We were ALL unskilled at some point !!!

Reply | Quote

Doc,
First I appreciate your patience. Oh, the horrors of unskilled labor.
This is what I did to rename Ptsnoop.
Rebooted. Used Ctrl/Alt/Del to bring up the Close Program window, high
lighted Ptsnoop and clicked End Task. Went to C:WindowsSystem to find
Ptsnoop but it is not there, it’s in C:Windows. Per your instructions I
renamed Ptsnoop.exe to Ptsnoop_old.exe minimized the window and tried to
connect. Had no trouble connecting. I know the connection was good because
my (McAfee) Firewall detected several pings and I checked my E-mail (Outlook
Express). I again looked at the Close Program window to see if Ptsnoop was
there and it was not.
Before closing C:Windows I changed the name back to Ptsnoop.exe.
When I was in the process of putting this info together to post to the
Lounge, my machine froze. I hit Ctrl/Alt/Del to try and back out but was
awarded a Blue Screen. I hit the space bar and the screen went black. It was
necessary to push On/Off button.
I had no trouble rebooting after the “Did not shut down properly scan”.
Oops, I forgot to include the following;
It would seem that in my case Ptsnoop is not part of the modem. Which leads me to ask why didn’t my McAfee virus scan or Adaware find it. And, should I get rid of it and how?

Reply | Quote

Mick,

You could try that . If the machine lets you, then see if you can get online. If not, then we can be pretty certain that it’s for the modem. If you speak DOS (and I don’t, at least not well) you can rename it from a command prompt, but that’s probably not worth the trouble. Easier just to remove the modem in Device Manager and then reboot and let Windows find it and install it. But just in case, make sure you have the drivers for it on a disk or the install software to do the reinstall manually before you uninstall it. Better safe than sorry !!

Reply | Quote

Doc . . . The machine told me “Can not rename file because it is in use”.
Do I need to use Ctrl/Alt/Delete and End Task to turn off PTsnoop before I can rename it? If so, what then?

Reply | Quote

Mick,

Sounds like we’re barking up the wrong tre with the Trojan if an up-to-date McAfee scan didn’t turn it up. One last test to see if it’s part of the modem’s software package. Open Windows Explorer and navigate to C:WindowsSystem and locate the PTsnoop.exe file and rename it to PTsnoop_old.exe. Minimize the window and then try to connect to the internet. If your modem won’t dial out and says it can’t find the file PTsnoop.exe then you’ll know that it’s for the modem. Then simply reopen the window you minimized and change the file name back to it’s original form. Close the window and try your to connect to the internet. If you’re still having problems after this, then we should think about removing your modem and letting Windows reinstall it from bootup. Post back with the results of the name change routine.

Reply | Quote

Doc,
I was a little nervous about digging into the PTSnoop issue. You wrote that any Virus software should detect this Trojan cuz it an old bug. I just ran my (up to date) McAfee Virus Scan and it found no problems. Can I assume that the PTSnoop on my machine is not a Trojan?
I do not run a virus scan on any particular schedule but do run it several times a month, and more often when I receive an attachment I believe to be infected. I never open attachments from people I do not know. All Spam and other undesirable junk gets packed-up and sent here;
spaminator@mindspring.com ; abuse@mindspring.com ; abuse@abuse.earthlink.net

Reply | Quote

Mick,
First off, I’d leave those 2 items AdAware found, alone.
obj[0]=RegData : .DEFAULTSoftwareMicrosoftMediaPlayerPlayerSettings
obj[1]=RegData : SoftwareMicrosoftMediaPlayerPlayerSettings
They appear to be registry settings for Windows Media Player. I’m not sure if they are a problem or not. You can tell AdAware to ignore them for now and if they are a problem you can always delete them later. Perhaps another lounger can help out here. Anyone ????
The Tracking Cookie from Gator is something you REALLY DON”T WANT. Let AdAware get rid of it !!!

The PTSnoop workaround is someone elses, not mine. I’m fairly certain that they meant “Semi-colon” but as we aren’t sure it’s best left alone for now. Again, you can uncheck PTSnoop on the startup menu and reboot. Then do a Control/Alt/Delete and see if it’s running.

One other question I should have asked earlier: Are you having a problem with rebooting or just shutdown ???

Reply | Quote

Doc . . . Per your notes;
I have nothing pending for the printer. (hpoddt01)
Unchecked TkBellExe on the start-up menu.
Updated my Adaware, ran a scan and found these;

ArchiveData(auto-quarantine- 22-09-2003 13-34-26.bckp)
============================================
WINDOWS

Reply | Quote

Take your time, and if you have questions or problems along the way, post back and we’ll try to sort through them. We are here to help.

First go to StartRun and type msconfig then hit enter and in the resulting window uncheck that “Tinkerbell” item (the one for RealPlayer) and reboot. See if that does it.

Reply | Quote

I’m a little slow at this computer stuff, Doc. It will take a day or two for me to sort through your suggestions. And there is one thing for sure. I don’t know what those items are either.

Reply | Quote

Mick,

Check out this information on PTsnoop and see how it applies to your particular situation. There seem to be several interpritations of the file (modem drivers or backdoor TROJAN !!!)

http://www.sophos.com/virusinfo/analyses/trojptsnoop.html%5B/url%5D Read this first.

http://www.f-secure.com/v-descs/ptsnoop.shtml%5B/url%5D

http://www.computing.net/windows95/wwwboar…rum/146843.html%5B/url%5D

Although ptsnoop can be spyware or backdoor trojan horse, in my case, it proved to be a legit file (ptsnoop.exe), which is on the drivers I used to install a modem (PCTEL) which I robbed out of my 98SE computer

I also took a look at the win.ini file and there was no ptsnoop.exe (if it were the backdoor virus it would have been) in it anywhere

You may want to try the following:

1. Click Start and choose Run.
2. Type SYSEDIT and click OK. The System Configuration Editor opens.
3. Click the WIN.INI title bar.
4. In the LOAD= line, you will see PTSNOOP.EXE. Place a colon in front of this line. For example:

;LOAD=PTSNOOP.EXE

Save changes.

Now click Start>Run and type Msconfig.

Click on the Startup tab and uncheck Ptsnoop

Now click Start>Run and type Regedit.

Go to the following key:

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun

If you see any reference to Ptsnoop.exe in the right hand pane, delete it, close Regedit and reboot.

I’m goin after TkBellExe next !!! [

Reply | Quote

Mick,

Here’s some info on TIckbellexe found here by following a link from here

TkBellExe msconfig-Startup-Entry
Is there an entry in your Startup “TkBellExe”, I have it and have Disabled it with Startup Cop and Unchecked it in msconfig and it alwise starts up when I open RealOne player. I checked the box in RealOne – Internet Settings – Only perform automatic services while RealOne Player is in use – which disables it when the player is off, but as soon as you open it, it reactivates the Startup – TkBellExe, anyways here is some info on it and a possible fix.

Details: TkBellExe
RealPlayer version: 6.0.10.505 RealOne ‘Free’ package
Registry Key Location:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
Key Name: TkBellExe
Value: CProgram FilesCommon FilesRealUpdate_OBevntsvc.exe -osboot

Put there unconditionally when RealOne is installed, stays there, and is recreated/updated when RealOne is started if you try to delete or change it. There is no option to disable this behaviour, although there IS an option within RealOne which supposedly makes it actively do stuff only when RealOne is being executed.
This is under “Internet Settings” as “Only perform automatic services while RealOne Player is in use”. When you try to Enabling this option, it begs you not to. When you enable it, it still DOES NOT remove the above registry key, however the evntsvc.exe process is terminated when RealOne is exited, and from that point on is started and closed in tandem with RealOne.
Note that the ‘Run’ registry key is still there, so I assume it doesn’t *allow* itself to start when realone isn’t running.
Regardless of the above setting, the TkBellExe registry key is still recreated/updated every time RealOne is run.
So far the only apparent action of the evntsvc process was to create a desktop shortcut link to Tiscali’s website, early in the morning. The initial memory footprint is 143kb – same as the exe size – in ram and about 450kb paged.
There is a resolution: it seems that if you delete evntsvc.exe, then RealOne does not complain about not being able to run it, and it no longer creates the registry key. It’s not exactly a documented technique though.

Doc here again – I’d suggest removing these two item (one at a time, of course) from your startup menu and see if that corrects the shutdown problem.

Reply | Quote

Mick,

Here’s some info on TIckbellexe found here by following a link from here

TkBellExe msconfig-Startup-Entry
Is there an entry in your Startup “TkBellExe”, I have it and have Disabled it with Startup Cop and Unchecked it in msconfig and it alwise starts up when I open RealOne player. I checked the box in RealOne – Internet Settings – Only perform automatic services while RealOne Player is in use – which disables it when the player is off, but as soon as you open it, it reactivates the Startup – TkBellExe, anyways here is some info on it and a possible fix.

Details: TkBellExe
RealPlayer version: 6.0.10.505 RealOne ‘Free’ package
Registry Key Location:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
Key Name: TkBellExe
Value: CProgram FilesCommon FilesRealUpdate_OBevntsvc.exe -osboot

Put there unconditionally when RealOne is installed, stays there, and is recreated/updated when RealOne is started if you try to delete or change it. There is no option to disable this behaviour, although there IS an option within RealOne which supposedly makes it actively do stuff only when RealOne is being executed.
This is under “Internet Settings” as “Only perform automatic services while RealOne Player is in use”. When you try to Enabling this option, it begs you not to. When you enable it, it still DOES NOT remove the above registry key, however the evntsvc.exe process is terminated when RealOne is exited, and from that point on is started and closed in tandem with RealOne.
Note that the ‘Run’ registry key is still there, so I assume it doesn’t *allow* itself to start when realone isn’t running.
Regardless of the above setting, the TkBellExe registry key is still recreated/updated every time RealOne is run.
So far the only apparent action of the evntsvc process was to create a desktop shortcut link to Tiscali’s website, early in the morning. The initial memory footprint is 143kb – same as the exe size – in ram and about 450kb paged.
There is a resolution: it seems that if you delete evntsvc.exe, then RealOne does not complain about not being able to run it, and it no longer creates the registry key. It’s not exactly a documented technique though.

Doc here again – I’d suggest removing these two item (one at a time, of course) from your startup menu and see if that corrects the shutdown problem.

Reply | Quote

Still having shutdown trouble despite downloading Windows 98SE shutdown patch per the suggestion by Doc.
For example, I tried to shutdown today with the following result.
-First I closed all open programs on the toolbar; Outlook Express, Mcafee (scan on line and firewall),
HP (printer-scanner-copier) and paused Task Scheduler.
-Pressed Ctrl-Alt-Delete (once) to look at Close Program window to see if there were any programs
(not responding).
The following programs were (still) running;
Explorer
Mpftray
Mpfagent
Mcvsrte
Mcvsescn
Hpotdd01
Systray
Ptsnoop
Realevent
Rnaapp
-Clicked Cancel in the Close Program window
-Click Start, click Ok (for shutdown).
-PC made some processing noises and the screen went blank with Windows green wall to wall.
I waited for a minute. Nothing happened.
-Pressed Ctrl-Alt-Delete twice and got a blue screen
-Pressed the space bar and got the Close Program window with the following list of items;
Hpotdd01
Systray
Tapisry
Rundll 32 (Not Responding)
-Clicked End Task
Got a black (dark gray) screen
Waited . . . . nothing.
-Pressed Ctrl-Alt-Delete twice
Got the black screen
-Pressed Ctrl-Alt-Delete twice
Blue screen
-Pressed space bar and got the Close Program window with the following list of items;
Mstask (Not Responding)
Hpotdd01
Systray
-Clicked End Task
Got a black screen
Pressed Ctrl-Alt-Delete twice
Blue screen
-Pressed space bar and got the Close Program window with the following list of items;
Hpotdd01
Systray
Spool 32 (Not Responding)
At this point it was necessary to press (and hold) the On/Off button to shut down.

The PC will reboot (after it does the “not shut down properly” scan)
The following items are Checked in the startup list;
CountrySelection
PTSnoop
StstemTray
MCUpdate
MCAgent
TkBellExe
SchedulingAgent
hpoddt01
hp instant support
hp psc 2000 series

I need more help.

Reply | Quote

Mornin’ Mick,

You seem to be in need of the Windows 98SE shutdown patch. This has been a known issue with Windows 98 machines for some time now. go here and read up on it (since you’re “not a computer wiz”). It will help you understand the problem and the process of downloading and installing the patch. The “Next” button on the Licence Agreement page will initiate the download. HTH.

If this doesn’t do the trick, post back and we’ll go down a different path. It could be McAfee, but let’s look “in house” before going out looking for trouble.

Reply | Quote

Doc,
I am not sure if this is the correct place for this post or how many questions to ask at one time. Also, I am not computer wiz. Not by a long shot. Most of my time on the computer is spent going through e-mail from the 12 hobby lists I subscribe to. I recently replaced a Cannon BJ4100 series printer with a HP psc 2110 all-in-one printer-scanner-copier.
Hardware and Software are as follows;
Compaq 7470
AMD-K36 3D Processor at 533 MHz
64 MB RAM with 128 RAM added (184 RAM total)
50% System Resources free
Windows managed swap file on C drive (13288 MB free)
Available on C drive 13288 MB of 16277 MB (FAT 32)
Available on D drive 1653 MB of 2792 MB (FAT 32)
Win-98 4.10
IE 5 6.0
McAfee;
Virus Scan 8.0
Engine Version 4.2.60
Dat Version 4.0.4292
Dat Created 9-10-03
Firewall v4.5
Version 4.5.2.30

As you must know, McAfee is having problems that to my knowledge are not corrected and may very well be complicating my problems. Some of my problems are;
-Freeze when shutting down. Have tried Ctrl-Alt-Del with some success. Usually necessary to power-down with on/off button.
-Freeze during reboot shortly after desktop Icons appear. Must power-down with on/off button. Have done this as many as 3 times before a complete reboot.
-IE will stop responding during send/receive process. This did not happen before McAfee’s recent problems.
-The troubleshooting utility and Compaq Built-In Technician do not function.

I will stop here for now and ask if this info is what is needed for diagnostics? And, would this be better posted to another area of the Lounge?

Mick Weis – FLH rider

Reply | Quote

Hi nuglorious !!

[indent]

---

I do NOT recommend that you install the optional updates (I’ll shoot Windows Update if it tries to stick Internet Explorer 6 on my Windows 98 system again).

---

[/indent]

This quote is from Woody’s Windows Watch #8.36 and would appear to indicate that your problems are due to the upgrade to IE6. I had heard that there were issues with Win98 and IE 6 but it seems that Woody himself doesn’t like the combination and that is the best recommendation I know of to avoid it at ALL costs. You might be able to reinstall Windows 98 over itself and get back IE 5 in the process, but I’m not sure. You may have to resort to a clean install of Windows to rid yourself of the IE6 install. If you plan on upgrading Windows itself, you should go right to XP if your system will handle it. Sounds like it will, but just barely. I’d attempt to fix your current install before you consider an upgrade. But that’s just a personal observation.

Reply | Quote

hi cowboy
tks for your advised. I understand now.
As what Doc had mentioned, hes right as i read somewhere about this matter too about IE6. Hopefully nothing happen n if something crook up, i will follow your instruction to remove the IE6 n install IE5 instead.

Reply | Quote

hi cowboy
tks for your advised. I understand now.
As what Doc had mentioned, hes right as i read somewhere about this matter too about IE6. Hopefully nothing happen n if something crook up, i will follow your instruction to remove the IE6 n install IE5 instead.

Reply | Quote