Member Avatar for maxdax155

my operating system is win98 2nd ed.

Like many other's, my IE6 has been hijacked by res://mshp.dll/index.html#10213. But when I try to go to any different URLs I get the IE error message that says

This program has performed an illegal operation and will be shut down

EXPLORER executed an invalid instruction in module APPKU32.DLL at 017f: 01e2449a.

All the solutions to the res: problem that I've seen involve downloading a program to that computer. But I can't even access the internet from my laptop to download anything. I had to use my friend's computer just to be able to post. Does anyone know exactly what registry keys and files to look for so I can remove the problems "manually" in safe mode? I'm really new at this and I didn't even know what registry keys were until I started having this problem.

thanks in advance for help and input

  • 2 Contributors
  • 1 Reply
  • 117 Views
  • 9 Hours Discussion Span
  • Latest Post Latest Post by alc6379

Dani AI

Generated

For : since you cannot download tools on that machine, here is a compact, Safe‑Mode–friendly manual checklist of the registry locations and file places that hijackers commonly modify on Windows 98 SE, and the safe steps to remove them. This builds on 's suggestion about disabling startup items by showing the actual keys and how to undo what a hijacker typically does.

  • Important preparatory notes: boot to Safe Mode, run Regedit, and EXPORT any key before changing it. Keep a copy of any file you remove by renaming it to .old rather than deleting immediately.

  • Registry places to inspect (use Regedit -> Find to look for any suspicious DLL/filename you see in error messages):

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
HKEY_CLASSES_ROOT\http\shell\open\command
HKEY_CLASSES_ROOT\htmlfile\shell\open\command
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings

  • How to remove a Browser Helper Object / malicious COM DLL:

    1. Note the CLSID under the Browser Helper Objects key.
    2. Open HKEY_CLASSES_ROOT\CLSID\{CLSID}\InprocServer32 to find the DLL path.
    3. In Safe Mode run: regsvr32 /u C:\path\to\that.dll to unregister.
    4. Rename the DLL to that.dll.old and delete the CLSID and BHO registry keys.
    5. Reboot and test.

  • Other useful checks: open C:\Windows\hosts and remove unexpected entries; check ProxyEnable/ProxyServer under the Internet Settings key and clear them if present; review WIN.INI and SYSTEM.INI for strange Run lines.

If Explorer still crashes after cleaning registry references and removing files, plan a repair install from the Windows 98 media or restore any corrupted system DLLs from known-good sources. Manual registry cleanup can fix many hijacks, but always keep backups and proceed cautiously.

Member Avatar for alc6379

Like many other's, my IE6 has been hijacked by

<snip>

All the solutions to the res: problem that I've seen involve downloading a program to that computer. But I can't even access the internet from my laptop to download anything. I had to use my friend's computer just to be able to post. Does anyone know exactly what registry keys and files to look for so I can remove the problems "manually" in safe mode? I'm really new at this and I didn't even know what registry keys were until I started having this problem.

thanks in advance for help and input

"Like many others", eh?

If you cannot boot your system into normal mode, but you have access to another system, can you just burn the needed programs to CD, or copy them to a floppy? You should be able to run them in safe mode once you've got them downloaded.

Additionally, MSCONFIG works really well for disabling items in 98. Boot to Safe mode in 98, click on start, then Run, then punch in msconfig, and click OK. Click on the startup tab, and then click "Disable All". Click OK, then restart, and you should be able to at least get into Windows in Normal mode to do what you need to do. After running some type of spyware scanner or something, be sure to go back into MSCONFIG and enable what's left in there.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.