Can't remove IE 6 and OE 6 and can't reinstall

I have followed the instructions in Knowledge Base Article 263837 for
removal of Outlook Express in Windows 2000. Unfortunately it didn't work.
Virtually all of the files that were deleted keep showing up again. In
addition, Outlook Express is showing up, but the address book disappeared.

I have repeated the procedures several times and same problem occurs.
Original problem was that Outlook Express wouldn't open up. In addition, the
address book would save entries under shared contacts instead of "main
identity". Any idea what is going on?

I noticed that a program called mssvc32.exe starts up at bootup. This did
not show up in the search screen and is flagged by my anti spyware program at
startup. What is this program? Who put it in here and what does it do.

You likely have a message store corruption problem and reinstalling won't
fix it. Try deleting folders.dbx (hidden) and see if OE will start then.
See point 9 for more details and do points 2 and 3 once you get it up again.

I have no idea what that program is, but if its spyware, get rid of it. See
point 11 below also to disable it at startup.

steve

"ZCorker" wrote in message
...
I have followed the instructions in Knowledge Base Article 263837 for
removal of Outlook Express in Windows 2000. Unfortunately it didn't work.
Virtually all of the files that were deleted keep showing up again. In
addition, Outlook Express is showing up, but the address book disappeared.

I have repeated the procedures several times and same problem occurs.
Original problem was that Outlook Express wouldn't open up. In addition,
the
address book would save entries under shared contacts instead of "main
identity". Any idea what is going on?

I noticed that a program called mssvc32.exe starts up at bootup. This
did
not show up in the search screen and is flagged by my anti spyware program
at
startup. What is this program? Who put it in here and what does it do.



1. Don't open attachments.

Most computer infections are the result of the user opening email
attachments. The attachment usually contains a virus or worm or trojan that
infects the system when it is opened.

Because of this tendency of attachments to infect, Microsoft has now set OE
to block all attachments. See
these articles for explanations:

Cannot Open E-Mail Attachments in Outlook Express After You Install SP1
http://support.microsoft.com/?kbid=329570

OLEXP Using Virus Protection Features in Outlook Express 6 (Q291387)
http://support.microsoft.com/support.../Q291/3/87.ASP

Note that Microsoft does not send security patches in email. See this
article:
http://www.microsoft.com/technet/sec...patch_hoax.asp

If you choose to adjust OE to allow attachments, make sure you save the
attachment to disk first and then scan it with your antivirus software.

The most significant thing you can do to prevent such infections, is to
educate yourself on what attachments may constitute a threat to your system,
and never open any such attachments, no matter who they are from.



2. Turn off Background Compaction. (Note that with WinXP SP2, this feature
is already disabled.)

When a message is deleted, moved or marked as read in an OE message file
(dbx), then wasted space is generated in that file, and the folder must be
compacted to remove that wasted space.

By default, OE turns on a feature under Tools | Options | Maintenance called
"background compaction", which turns itself on if the folders in your
message store get too much wasted space. This feature uses 100% CPU time
and slows down your system, while it is active. In addition, if the process
is somewhat interrupted, then the entire message store can become corrupt.

To prevent such corruption, turn off background compaction under Tools |
Options | Maintenance for each Identity you have, and then compact manually
and frequently using File | Folder | Compact all. This will make OE more
stable.


3. Turn off email scanning in your antivirus software.


Antivirus software invades the Outlook Express program to try and intercept
(incoming and, in some cases, outgoing) messages that might contain virus.

The problem with this approach is that the antivirus software can trigger
the destruction of an entire message folder or the entire message store,
when it attempts to remove a message containing a potential virus.

To prevent the possibility of such destruction occuring, turn off email
scanning in your antivirus software. You will still be protected against
infection. If you attempt to open a message attachment containing a
potential virus, then your antivirus software will recognize that your are
attempting to infect your system, and will block you from doing so. The
best practice on the user's part is to save an attachment to disk and then
scan it with the antivirus software prior to opening it. Messages opened
themselves (if you have the latest security updates from Windows Update)
will not infect your system -- only attachments.

You do not need additional email scanning on top of your system being
continuosly scanned by antivirus software, so turn off email scanning to
prevent destruction of your message store.

From a post by Frank Saunders:

From
http://service1.symantec.com/SUPPORT...ail,protection

Disabling email protection does not leave you vulnerable to viruses and
malicious software in email. It is a separate layer of protection in
addition to Auto-Protect. Auto-Protect scans any incoming files, including
email, as they are saved to your hard drive. As long as you keep your virus
definitions up to date with LiveUpdate, and keep Auto-Protect enabled and
set to scan files as they are created or downloaded, your system is fully
protected.


4. Recovering lost messages.


The most significant contributors to lost messages are described in points 2
and 3 above. Turn these options off to prevent message store corruption.

If you do lose your messages, you can try using my DBXtract program to
attempt to recover the lost messages. Note that dbx files are hidden in
Windows 2000 and Windows XP.
http://www.oehelp.com/DBXtract/

Alternatively one can also use DBXpress, which is faster and more accurate
than DBXtract,
and it also has the capability of reading directly from the disk and
bypassing the file system.
http://www.oehelp.com/DBXpress/

If you have upgraded your version of IE and OE or your OS version, and all
your messages are lost, then see this article (note that the technique in
the article does not only apply to the issue addressed in the article
title):

OLEXP: Mail Folders, Address Book, and E-mail Messages Are Missing After You
Upgrade to Microsoft Windows XP
http://support.microsoft.com/default...b;en-us;313055

If File | Import | Messages does not work, ignore the error message, which
is erroneous in itself, and try one of the following techniques to get your
messages back:
a. Right click on each dbx file or a selection of them and go to Properties
and clear the read only attribute of the files. Then try File | Import |
Messages again.
b. Import the dbx files individually. See the last paragraph on this page
for how to do that:
http://www.oehelp.com/backup.aspx
c. As a last resort use DBXtract or DBXpress
http://www.oehelp.com/DBXtract/ or http://www.oehelp.com/DBXpress/

See also: http://insideoe.tomsterdam.com/probl...s.htm#mailgone


5. How does one reinstall IE and OE?

This article seems to work for other OSs than just XP:

How to Reinstall or Repair Internet Explorer and Outlook Express
http://support.microsoft.com/default...;EN-US;Q318378

See point 11 below first.


6. How does one backup and restore or transfer OE messages and settings:

See: http://insideoe.tomsterdam.com/backup/index.htm
http://www.oehelp.com/backup.aspx

Note that there is also a link in this article to MVP David Guess's free
OEBackup programs (www.oehelp.com/OEBackup/)



7. Links in email don't work:

see the links on this page

http://www.oehelp.com/


8. Outlook Express is slow.

See the various performance issues and how to address them on this page:

http://insideoe.tomsterdam.com/problems/performance.htm


9. Outlook Express won't start.

This is usually due to a conflict between what is recorded in the registry
and what is in the message store. Often, one can fix this problem by
deleting folders.dbx. If that doesn't work, then try moving all the dbx
files to another directory and see if that fixes it. Alternatively, see
these articles and also point 4 above:

http://insideoe.tomsterdam.com/probl...ce.htm#nostart

http://support.microsoft.com/support.../q245/4/19.asp


10. Address book information:

see The Windows Address Book

http://insideoe.tomsterdam.com/files/wab.htm


11. Installation issues:

Most of the problems with a faulty installation are due to other programs
running during the install and interfering with the updating of necessary
files. Antivirus software is notorious for this. To minimize such
interference, in Win98, WinMe, and WinXP go to Start | Run and type msconfig
and disable all startup items and non Microsoft services. Then reboot.
Then proceed with the installation. Startup items can then be re-enabled.

For additional info see:

Win98:
http://support.microsoft.com/default...65&Product=w98
WinXP:
http://support.microsoft.com/default...&Product=winxp

Since Win2000 does not have msconfig, one has to manually go to this
registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run

You can export this key and then delete all values under it. Then disable
all antivirus services under Computer Management | Services and then reboot.
Then install. After the installation you can import the key back into the
registry to restore the values and re-enable the services.


12. Screening unwanted email and Spam

Everybody gets unwanted email these days. Much of this email is either
trying to sell you something you probably don't want or else is trying to
infect you with a virus via an email attachment. What can you do?

a. Never open an attachment. First save an attachment to disk and then
scan it with your antivirus software to ensure it is not infected (make sure
your antivirus software definitions are up to date). If the attachment is
from someone you don't know, don't even bother opening it. Its not worth
it. See also point 1 above.

b. Screen email. Disable the Preview Pane (you can put a button on the
toolbar to turn this on and off). Then go to View | Columns and enable most
of the headers. That way you can scan the headers and pick out the various
obvious unwanted mail. Once you find messages that you don't want to open,
select the headers of those messages without opening the messages and
perform a Shift-Delete to permanently remove them from the folder. Once
they are removed, they will no longer be accessible, so don't do this on
messages you might wish to keep.

c. On messages left that might be worth opening, go to Tools | Options |
Read and check the box that says "read all messages in plain text"
(available only with IE6 SP1 or WinXP SP1 and higher). Reading in plain
text prevents any returns to the spammer's server, so your email address
cannot be validated in that fashion. In addition, it prevents malformed or
malicious HTML code from executing. If you find the message is worth
viewing as HTML, then you can go back to Tools | Options | Read and uncheck
the option to read in plain text only and then reopen the message to view it
as HTML (note that you can put this button on a toolbar with OETool
(www.oehelp.com/OETool/). You can also use OETool to view the message
details without having to open the message. You can also use the "Compact
Current Folder" button after deleting to shrink the file size.

d. If you get unwanted email repeatedly from the same source, you can set
up message rules to block out some of these messages. See the help file in
OE and also

http://insideoe.tomsterdam.com/tips/rules.htm

and

http://www.mindspring.com/~oe_oh/message_rules.htm.


e. If you find a message that is spam and that offends you or is deceptive,
go to Message | Forward as attachment and send it to .

The US Federal Trade Comission is launching a major crackdown on deceptive
and offensive spam. Visit their site at www.ftc.gov/spam for more info.


13. Messages appear blank

From a post by Frank Saunders:

Several possible causes and therefor several possible fixes:
1. Go to Start | Run and type
regsvr32 inetcomm.dll
and press Enter
2. Go to Tools | Options | Read | Fonts and set Western (ISO) as the
default.
3. Clear Temporary Internet Files and the Temp folder.
4. Turn off email scanning in your anti-virus.
5. Someone else reported that re-installing OE using method 2 in this
article fixed the problem:
How to Reinstall or Repair Internet Explorer and Outlook Express in Windows
XP
http://support.microsoft.com/?kbid=318378
Method 2 works on earlier versions of Windows.
6. Eliminate any scumware.
See
Dealing with Unwanted Spyware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm
especially
http://mvps.org/winhelp2002/unwanted.htm#Coolwebsearch

Note that AdAware and SpyBot S & D will each catch some things the other
won't. Also, each needs to be updated before every use, even when just
downloaded. There's also a lot more to do than just those two programs.
CWShredder is also available he
http://www.kellys-korner-xp.com/regs...cwshredder.zip
**Post your HijackThis log to
http://forums.spywareinfo.com/ or the Spyware forum at
http://forum.aumha.org/ for expert analysis, not here.**
Alternative download pages for Ad-Aware, Spybot, HijackThis and CWShredder
may be found on this page:
http://aumha.org/a/parasite.htm.
If trying everything at that site does not fix the problem please post back
in the same thread.

14. Issues with WinXP SP2.

For general information on WinXP SP2 see:

Windows XP Service Pack 2 Resources for IT Professionals
http://www.microsoft.com/technet/pro.../winxpsp2.mspx

For Internet Explorer changes with SP2 see:


Changes to Functionality in Microsoft Windows XP Service Pack 2: Part 5:
Enhanced Browsing Security
http://www.microsoft.com/technet/pro.../sp2brows.mspx

883256 - How to manage Internet Explorer add-ons in Windows XP Service Pack
2
http://support.microsoft.com/default...b;EN-US;883256

For Outlook Express changes with SP2 see:


Use the New Security Improvements in Outlook Express
http://www.microsoft.com/windowsxp/u...eb/sp2_oe.mspx

Changes to Functionality in Microsoft Windows XP Service Pack 2
Part 4: Email Handling

http://www.microsoft.com/technet/pro.../sp2email.mspx


Also:

835935 - Release notes for Windows XP Service Pack 2
http://support.microsoft.com/default...b;en-us;835935

Changes to Functionality in Microsoft Windows XP Service Pack 2Part 1
Introduction
http://www.microsoft.com/technet/pro.../sp2chngs.mspx

842242 - Some programs seem to stop working after you install Windows XP
Service Pack 2
http://support.microsoft.com/default...b;en-us;842242

884130 - Programs that may behave differently in Windows XP Service Pack 2
http://support.microsoft.com/?kbid=884130





I've left off some issues, but I believe these address the most
common problems that users encounter with OE. In addition, please check the
websites of the individual OE MVP's that address other issues not listed
he


Tom Koch:
http://insideoe.tomsterdam.com/

David Guess
http://www.mindspring.com/~oe_oh/

Jim Pickering
http://home.comcast.net/~jimpickering/

Frank Saunders
http://www.fjsmjs.com/OE/index.htm

and my site at http://www.oehelp.com


If you don't find your problem addressed, then feel free to post a question
in these newsgroups and we will be more than happy to respond and attempt to
help. Just go to Tools | Accounts | Add | News and add msnews.microsoft.com
as a newsserver and then you can address your question to the appropriate
newsgroup.

"ZCorker" wrote in message
...

I noticed that a program called mssvc32.exe starts up at bootup. This
did
not show up in the search screen and is flagged by my anti spyware program
at
startup. What is this program? Who put it in here and what does it do.

That's most likely an infection with this trojan/worm, dropped during a Chat
or other IRC session:

Sophos virus analysis: W32/Agobot-ME:
http://www.sophos.com/virusinfo/anal...2agobotme.html

It can be removed with a registry edit, but review the information about the
worm at the link above.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The
registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry'
menu, click 'Export Registry File'. In the 'Export range' panel, click
'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run \
mssvc32 = mssvc32.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Run Services\
mssvc32 = mssvc32.exe

and delete them if they exist.

Close the registry editor.
--
Jim Pickering, MVP-Outlook Express
Please reply only to newsgroup.

Besides what Jim posted (more on that below)...

Original problem was that Outlook Express wouldn't open up.

See these pages, in order:

http://insideoe.tomsterdam.com/probl...htm#foldersdbx

http://insideoe.tomsterdam.com/probl...ce.htm#nostart

(http://support.microsoft.com/?kbid=245419)

...the address book disappeared

Care to elaborate on that? Address Book can't be found? Doesn't open?
Error message pointing to Address Book?

Is MS Office or MS Outlook also installed?

You may have some involved steps to take to remove W32/Agobot.[variant] from
your system (e.g.,
http://www.trendmicro.com/vinfo/viru...WORM_AGOBOT.WU).

Dealing with Trojans & Hijackware (Do both A and B, cos "you never know"):

A. Trojans

1. Check in at Windows Update and install all critical updates & reboot.

2. Download and run Stinger (http://vil.nai.com/vil/stinger/); then...

3. Update your virus definitions, enable Show Hidden Files
(http://service1.symantec.com/SUPPORT...02092715262339)
and then run a full system scan in Safe Mode
(http://service1.symantec.com/SUPPORT...01052409420406)
with nothing else running in background. Note the files identified and
removed then find the corresponding page for the file at your AV maker's
online support pages (e.g.,
http://securityresponse.symantec.com...favorites.html)
and follow *all* Removal steps, including editing the Registry if directed.

WinXP Only (WinME similar): If this scan finds anything, create a new
Restore Point then:

Disk Cleanup More options Delete all but the most recent Restore
Point.

B. Hijackware

Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/Darnit.htm

CoolWebSearch Chronicles
http://www.spywareinfo.com/~merijn/cwschronicles.html

Run these tools in the following order with nothing else running in
background:

1. CWShredder v1.59.1 (no updates available currently; fix all found)

2. Ad-Aware SE (reconfigure per Post #2 in
http://aumha.org/forum/viewtopic.php?t=5877; fix all found)

3. Spybot (RTFM but generally fix everything in red)

Important: You must seek updates for Ad-Aware, Spybot, etc., before each and
every use, even "right out of the box". But even they can't catch
everything, 24/7. When all else fails, HijackThis
(http://forum.aumha.org/downloads/hijackthis.zip) is the preferred tool to
use. It will help you to both identify and remove any hijackware/spyware.
**Post your files to http://forums.spywareinfo.com/ or
http://forum.aumha.org/viewforum.php?f=30 for expert analysis, not here.**

[Alternate download pages for many of the above tools may be found at
http://aumha.org/a/parasite.htm.]

So How Did I Get Infected Anyway?
http://boards.cexx.org/viewtopic.php?t=957
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE), AH-VSOP

Are You Ready for WinXP SP2?
http://www.microsoft.com/athome/secu...t/default.aspx

WinXP SP2 Release Notes
http://support.microsoft.com/default...b;en-us;835935

AumHa Forums
http://forum.aumha.org

ZCorker wrote:
I have followed the instructions in Knowledge Base Article 263837 for
removal of Outlook Express in Windows 2000. Unfortunately it didn't work.
Virtually all of the files that were deleted keep showing up again. In
addition, Outlook Express is showing up, but the address book disappeared.

I have repeated the procedures several times and same problem occurs.
Original problem was that Outlook Express wouldn't open up. In addition,
the address book would save entries under shared contacts instead of "main
identity". Any idea what is going on?

I noticed that a program called mssvc32.exe starts up at bootup. This
did
not show up in the search screen and is flagged by my anti spyware program
at startup. What is this program? Who put it in here and what does it
do.