Author Topic: Help! (Read 5416 times)

jonno_w · « **on:** May 01, 2006, 21:18 »

Hi folks. I'm having two problems with my PC and am hoping you clever people can help.

[1] My sister sometimes uses the computer and is keen on chatrooms. Somehow she has managed to change the wallpaper to one provided by a website called 'chatagogo.co.uk'. Although I've managed to reset the wallpaper to one provided by Windows, the chatagogo wallpaper appears for several seconds while my PC is booting up. I don't like this, and want to completely remove it from my machine. Any ideas?

[2] When I'm starting up my PC, I get a window which contains the message: "Ibm00001 has caused an error in IBM00001.DLL. Ibm00001 will now close. If you experience any problems, try restarting your computer." At the same time that this message has started to appear, my broadband internet connection has virtually seized up. As I have absolutely no idea what this message means, could it be related to the slowness of my internet connection? And if so, can anyone suggest a remedy?

The computer runs Windows ME. Advice would be much appreciated. Cheers.

jonno_w · « **Reply #1 on:** May 01, 2006, 21:21 »

Hi, it's me again. I should have mentioned, so far I've tried downloading Windows updates and running system restore. However, neither of these have helped. I have Spywarelaster and Spybot installed too, both updated and activated.

Clive · « **Reply #2 on:** May 01, 2006, 21:38 »

Hi Jonno and

It may be that chatagogo has added itself to your start up files which might explain the wallpaper showing up during boot-up. Click on Start/Run and type MSCONFIG Click on the Start Up tab and see if you can find chatagogo. If it's there, untick it, click apply and OK. You may have to re-start and it will warn you that you have made a change to the way Windows starts. That's OK - just ignore it.

It certainly seems as if you have spyware or something slowing down your computer. I know you already have some excellent antispyware programs installed, but it may also be worth trying AD-AWARE

Remember to update it before you use it. I think that removes the dreaded SpySherriff which is often associated with Ibm00001 errors.

Simon · « **Reply #3 on:** May 01, 2006, 22:07 »

Hi Jonno,

You could also try Ewido, which is very effective at removing nasty spyware and trojans.

Good luck!

jonno_w · « **Reply #4 on:** May 03, 2006, 20:10 »

Brilliant. Thanks for the prompt replies, guys. Due to work comitments away from home it'll be Monday before I can try out your suggestions, but I shall report back and let you know how it went.

If anybody else has any suggestions, please leave them too in case I don't have any luck with the above.

Cheers!

sam · « **Reply #5 on:** May 03, 2006, 20:15 »

good luck.

Mac · « **Reply #6 on:** May 03, 2006, 20:19 »

Upgrade to XP if you can. But do a clean install.

jonno_w · « **Reply #7 on:** May 08, 2006, 18:25 »

Hi guys. I did start - run - misconfig, and although I didn't find anything with any reference to chatagogo I did find "C:\WINDOWS\SYSTEM:ibm00001.exe". I unticked this, clicked apply and restarted the pc. Did I do the right thing, or have I inadvertantly invited more doom and chaos? Web pages still seem to be loading slow-ish. I have updated and run Adaware, Spyblaster and Spybot. Is there anything else I can try?

Sandra · « **Reply #8 on:** May 08, 2006, 18:51 »

Apparently its a trojan John

http://www.justtext.com/processes-tasks/ibm00001-exe.html

See if you can find it in add/remove and remove it but its probably not there.

Delete it from here in safe mode with System Restore turned off :

File or folder location:
The actual hard drive location will be at C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe

jonno_w · « **Reply #9 on:** May 08, 2006, 19:07 »

Sandra, many thanks for the advice but you credit me with too much technical knowledge. I'm sure you can advise me though.

1) How do I turn off System Restore?
2) Safe Mode - is that accessed by repeatedly tapping F8 as the computer starts up?
3) Would I find that location via My Computer?

Your advice sounds very helpful but unfortunately I am an idiot and would appreciate your help.

Cheers.

Simon · « **Reply #10 on:** May 08, 2006, 20:10 »

1) To disable System Restore, right click your My Computer desktop icon, and select Properties, then the System Restore tab. Untick the box, to switch off System Restore. It may take a few seconds to deactivate. Don't forget to enable it again, once you have cleaned your machine.

2) Yes.

3) See above.

You might also want to try Ewido, which seems to be able to find and remove some of the more recalcitrant trojans and spyware.

Oh, and you cannot be an idiot, or you would not be here.

jonno_w · « **Reply #11 on:** May 08, 2006, 20:54 »

I really appreciate you guys' help, but now I'm starting to get a headache. I have followed the above instructions but Sandra's suggested location yielded only four icons which read as follow:

MSONEXT.DLL
MSOWS409.DLL
PUBPLACE
RAGENT.Dll

There's no sign of anything pertaining to this ibm00001 thing. Any ideas what to do next? Actually I am a bit of an idiot; this is sort of the pc equivalent of ground crew talking down a willing but unknowledgable civillian airline passenger in the cockpit after the proper pilot has conked out. Your help is hugely appreciated!

Clive · « **Reply #12 on:** May 08, 2006, 21:55 »

Ha! You found your suspect Jon. PUBPLACE is a trojan known as Downloader-LC. I'm surprised that none of the detectors you used found it, but wait for Sandra to return before deleting it though.

jonno_w · « **Reply #13 on:** May 08, 2006, 22:06 »

Brilliant. You guys are stars. I'll keep checking back. This thing is driving me nuts; I really appreciate your help. Cheers.

Simon · « **Reply #14 on:** May 08, 2006, 22:11 »

Did Ewido find anything, Jonno?