Windows ME Fixes

Actually, Windows ME is very stable (well can be), if you remove a few default software modules, remove any/all Malware including ADware, Spyware, Fostware, Browser hijackers, Virus, Worms and Trojans, install all Windows Updates, then update all device drivers, clean up your disk drive and make sure your hardware is OK. And then do some Security changes.

These suggestions are for Windows ME, but many apply to other versions of Windows. With these changes a Windows ME system can be made reliable and more stable than a Windows 98/98se system. Please read through this page and links first before making changes, so that you have a clear understanding of what you might need to do. Items should be checked and fixed in the sequence listed. Reboot and check after each change that you chose to make.

For example: Memory failures or overclocking can cause random program hanging or reboot symptoms. You must test memory outside of Windows with a standalone memory test. Use the system board BIOS CMOS Setup function to set memory values to default settings. Setting memory DRAM Timings to "Turbo" or "Fast" instead of the "Normal" setting on systems that support these options can cause problems.

Run a standalone memory test from a DOS boot diskette. Get Memtest86_v3.2 (by Chris Brady) installable from Windows and DOS version 3.2, or Memtest86+ v1.65 (DOS-Win), and/or DocMemory_v2.2b, and make their boot diskette(s). Or make the Ultimate Boot CD that has these tests on it. You should be able to run these memory tests for at least 12 hours without errors to test your hardware, before you suspect Windows ME is the cause of reboot or hang problems.

If a Windows ME system has more than 512MB of RAM, then to work around a design bug in the vcache management, per MS_253912, you must add the following to the [vcache] section of C:\Windows\SYSTEM.INI file:

If more than 1024MB (1GB) RAM, then a second entry in SYSTEM.INI is required in the [386Enh] section per MS_304943 to limit Windows ME to using just 1GB of physical RAM:

These two changes should be made regardless of your current memory size, in case you later decide to add more memory or move your disk drive to a system with more than 640MB of memory.

Note: Installing Windows ME - Because of this design bug, physical memory must be reduced to 640 MB or less during the install of Windows ME from a Microsoft Retail CD and during initial install of chip set and video drivers. After these changes have been made to the SYSTEM.INI file, the additional memory can be put back into the system. Some of the new integrated video chip set drivers will crash during booting if these patches are not installed.

While Windows ME can run on systems with just 32MB RAM, it is very slow and prone to random errors. It works at 64MB, but it is best to have at least 128MB of memory. 256MB is enough for most applications and users, and makes the system more responsive and stable. You do NOT need any memory managers or optimizers with Windows ME. They do little, other than take up memory (see Rainmaker Redux). Windows ME already has the best memory manager you can get (without switching to Windows XP Pro). Let Windows ME manage your virtual memory (default), unless you have a special case (like an editor for large graphics files). Never set a Maximum swap file size!

When rebooting, random hangs after the initial Windows ME splash screen, with it, a blank screen or a DOS text screen, can be caused by the system board's BIOS Plug and Play configuration data (DMI or ESCD) being corrupted or wrong for the current hardware configuration due to hardware changes or failures. To clear the DMI or ESCD data, enter the system board's BIOS CMOS Setup utility (normally the DEL key during the Power On Self Test). Go to the PnP/PCI Configurations section and Enable the Reset Configuration Data or ESCD option if present. Then save the setup (even if no changes are made) and exit. BIOS will rebuild the DMI Configuration table, to correct for any hardware changes.

This type of hang can be caused by failing hardware, loose PCI adapter cards, back level or corrupted device drivers, and USB cables that are defective or too long. Using the boot menu BootLog option several times and then looking at the hidden C:\BOOTLOG.TXT file can often help identify what hardware is causing the problem.

Failing IDE disk drives/CD-Rom or loose or shorted cables can cause the PnP boot process to disable full IDE support. This can result in Windows ME not finding your CD-Rom and other IDE removable media. To fix that problem, RUN - REGEDIT and search for NOIDE and remove this Registry error flag, exit Regedit and reboot.

Hangs that occur after the normal light blue screen are usually caused by software problems, such as corrupted programs, ADware/Spyware, Virus/Trojans, or programs that did not install correctly.

System Power supplies age with use and heat. Their wattage output slowly drops after several years. And the addition of CD-RW/DVD and second disk drives sometimes overload the minimal power supplies that come with low cost systems. These often come with only a 240W or less power supply. An overload power supply is susceptible to AC line noise and can cause random hangs and resets. To check for the required power usage of your current system configuration or planned changes see Power Supply Wattage Calculator. Also check that the power cord is plugged into an outlet with a good ground connection and that a cheap extension cord is not being used. Use of a small UPS (Uninterruptible Power Supply) to ride out brief AC power interruptions is recommended.

Power supplies also power a small part of the system board, even when powered off, for the Power On Switch to work. This and other very low power leakage current from attached displays, printers and Ehternet cables attached devices, can cause strange system startup and shutdown hangs. Try pulling all power plugs, and cables to other always on devices like modems and phone lines, and let set for half an hour.

Windows Exception errors {0D: - 0E:} and system slowdowns or stalls can sometimes be caused by damaged disk drives. Powering off a system while it is writing to the disk can sometimes cause damage to the permanent address marks and sync fields. This can result in read/write errors that slow down the system or corrupt programs or data.

Running ScanDisk in Thorough mode or FORMAT often will flag these areas as bad. If you suspect this type of error on the disk drive, you need to run the disk drive manufactures quality check program to find out what errors are on the drive. These run from standalone boot diskettes. If the drive is damaged, the only way to fix it is to use these utilities to do a LOW LEVEL FORMAT of the drive. Often recovers full use of the drive, as there is really nothing wrong with it. A Low Level Format will of course erase everything on the drive and you will have to run FDISK and FORMAT before installing the Windows Operating System and your applications and data again.

Running ScanDisk first in Thorough mode several times can bypass most of these errors and recover the data making the disk drive usable. If necessary, run SCANDISK C: from a Windows ME startup diskette. One of the advantages of running the DOS version of ScanDisk from the Windows ME startup diskette, is that it does not restart and it gives a visual representation of any areas that have already been found bad on the disk drive.

But if the problems come back, it is time to check the quality of the disk drive with its manufactures utility. Some will allow different types of Low Level Format operations to correct problems, but risk losing all data. Backup your drive first!

Quality check, repair and Low Level Format utilities:
Hitachi and IBM	Drive Fitness Test
Samsung	HUTIL (hutil-creator.exe)
Western Digital	DLG Diagnostic for DOS (Floppy)
Maxtor and Quantum	PowerMax
Compaq	Use system Diagnostics
Quality check and/or repair only:
Fujitsu	Diagnostic Tool
Seagate	SeaTools Desktop
Gateway	GWSCAN 5.09 or GWSCAN 3.15 (smaller than 10G)
generic ?	Ontrack Data Advisor v5 $20 or SpinRite v6 $89

Images of these free Disk and Memory diagnostics, along with other standalone utilities can also be found on the Ultimate Boot CD. Download the ISO image and burn your own bootable CD to access and run these programs.

Standard approach to this type of problem is to clean up the disk drive, run a full up to date virus scan, check for and remove ADware - Spyware - Browser Hijackers, update Windows ME with security fixes, and then remove some unnecessary programs.

Malware programs like ADware, Spyware, Browser Hijackers, Virus, Worms and Trojans can slow your system and Internet connection down and cause random blue screen errors from other programs. They cause popup ADs and may redirect your IE browser searches to less than desirable web sites or ADs. They are a security risk. Some stall your system if a software firewall is enabled.

The problem of Worms, Trojans and Bots on the Internet is now so bad, that no system should ever be connected to the Internet unless it is behind a hardware firewall router or has a software firewall in place. Even with Dial-Up, a system can become infected in less than one minute after making an Internet connection. At a minimum, Windows should have its default open ports closed. And all Security Updates installed as soon as possible.

First, run ScanDisk in Standard mode, to make sure the drives file system is OK. (Start menu - Programs - Accessories - System Tools - ScanDisk) If problems running ScanDisk, then reboot the system into SAFE MODE (hold down Ctrl or F8 key when rebooting, before the initial Windows splash screen, and at Boot Menu select the Safe Mode option) and run Scandisk. An additional advantage of Safe Mode is that it deletes some temporary control files, such as ShellIconCache, that might be corrupted. This allows Windows ME to correct some problems when it next boots into normal mode.

It is also a good idea to run ScanDisk in Thorough mode if you have the time, to make sure there are no hardware errors on the drive. This can take hours to run on a large disk drive. Be aware, when a software FireWall logs hits it will do writes to the disk drive. This will cause ScanDisk and Defrag to restart. To get around this problem you either have to disable the firewall logging, disable the firewall during scans, unplug the internet, or run ScanDisk after booting into Safe Mode. TaskMonitor, Scheduled Tasks (TuneUp, PCHealth), Automatic Updates, System Restore activity, Spyware/ADware and other background processes will also cause writes to the disk drive causing restarts.

In some cases it may be necessary to boot from a Windows ME startup diskette and run from the DOS prompt: SCANDISK C: to clear errors. MS Info.

Always run ScanDisk in Standard mode before running Defrag. If all errors in the disk file system are not corrected first, Defrag will be very slow to start and may stall at 0%. Note: The Windows ME version of ScanDisk and Defrag do not support disk partitions larger than 137GB.

Do a quick Disk CleanUp and clean out temporary files that you do not need, run (Start - Programs - Accessories - System Tools - Disk CleanUp) on your C: drive. The first time you run it, select the "Downloaded Program Files" line, click View button, and manually remove all "objects" shown that are not part of an installed application (such as SUN Java, AcroIEHlpr, Google, Yahoo!), in case one of these Active-X plug-ins are back level, infected or causing problems. They often cause Internet Explorer to hang or be sluggish. They will download again if required.

If you have an Anti-Virus program installed and updated (do a manual update to check), boot into Safe Mode and run a full virus scan and remove anything that it finds.

Then work through each of the following items to scan for and remove other Malware programs that might be infecting your system. Repeat as necessary.

Information on Spyware_ADware_Malware programs and Browser Hijackers, their removal tools, prevention tools, links about and discussion forums can be found at SpywareInfo. These types of Malware come hidden in "free" download software, like KaZaA and "Internet Accelerators", and can corrupt or slow down your system. They can be installed by some hijack web pages that hijack your browser settings. Once on a system they can open the door for other ADware, Spyware, Worms, Trojans and Virus to download and install. And they can even lock you out of Control Panel functions to prevent you from removing them. You can get help identifying the newest hijackers, related programs and current news at SpywareInfo_Forums.

You should start by updating and running a full scan with your installed Anti-Virus program. Or, an on line virus scan (see below).

You can use self help sites like Help2Go that offer simple procedures with lots of graphics showing you what to do.

A quick On Line check for common Internet Explorer browser Hijackers and parasites can be done at DOXdesk.com. If any are detected, Ad-Aware SE and Spybot S&D (below) can be used to remove them. This site has a good list of common Malware, with descriptions of them, history and manual removal procedures if needed.

Install the

_Spybot Search_&_Destroy v1.4 tool for deleting Spyware/ADware, common Trojans and Browser hijackers. After installing Spybot S&D, use Search for updates to update the program and its reference file list every week. Click Check for problems to scan and when done, delete all items in red found. Be aware that the Immunize function of Spybot S&D, if enabled, can block your access to some Control Panel functions, requiring the system administrator (you) to disable SpyBot S&D's immunize function first. You can also download SpyBot_S&D_at_MajorGeeks and the latest off line Reference Update package.

Another good and free Spyware/ADware remover you should use is Lavasoft's_Ad-Aware_SE. It finds and removes a large number of ADware programs, Porn Dialers and Ad related IE Cookies. Purchase version includes real-time detecting and blocking of Spyware-ADware. Download the free version of Ad-Aware_SE Personal at_MajorGeeks to scan for and remove Spyware-ADware. The first time you run it, you should select the Custom scanning options, then Customize and enable all checks that you can, and then run it. If any "Critical" items are found, check their box to remove them. When done, reboot system if problems were found so the files can be deleted. One option scans for Ads stored on your system, so they can be removed. Use check for updates now to update the reference files before using. For offline updating, download its Referencefile update.

A major problem is the rapid changing Browser Hijackers. Check for and remove older versions of the worst one, CoolWebSearch Browser Hijacker, with the CWS removal tool.
- The CWS Browser Hijacker prevents you from accessing Anti-Spyware sites. Use different browser, or a another system, to download CWShredder to a diskette.
- Download the older version CWShredder.ZIP v1.59.1 (by Merijn), extract, run CWShredder.exe, and click Fix.
- CWShredder was sold to InterMute, which was then bought by TrendMicro. Newer version at CWShredder v2.19 or newest at MajorGeeks.
- VBRun60 required on older versions of Windows.
- List in Excel format of URL and IP address known to spread CWS.

If you have the res://<random?>.dll/... About:Blank or Home Search Assistant versions of the CoolWebSearch browser hijacker (mfplay, szihy/javaqr, sp/cjfhb), try the specific removal tool, About:Buster v6.0 ZIP (by RubbeR DuckY {aka Marcin Kleczynski}). Download and extract to a folder like C:\HJT. If possible, reboot into Safe Mode and then run About:Buster where it can do a better job removing the infected files. Also About:Buster at_MajorGeeks.

If you have other Spyware removal programs, not listed above, look them up in Rogue/Suspect Anti-Spyware Products & Web Sites before using. There is information on both ripoffs and good products.

If you do not have a good up to date virus scan utility installed or there are problems with it, do a free on line AV scan at HouseCall_AV by TrendMicro. This will take a while to run but worth it to know that you do not have a virus, worm or common Trojan. If any are found and not removed, go to either PC-cillin or Symantec Removal Tools or McAfee_AV sites for information on the specific virus and removal tools and instructions. If HouseCall does not download and run, try getting the Klez removal tool at Symantec or McAfee Stinger and make sure this virus is not on the system. For a second opinion, try other On Line scans like Panda ActiveScan, CA eTrust 'Scan for Virus' or BitDefender.

Be aware that a virus file found in the C:\_Restore folder can not be deleted by virus scan programs, nor is it a threat. These disabled files should be removed by disabling system restore, rebooting and then enabling System Restore, to delete all of the old Restore Points, including the infected files. On Line virus scans can not remove some virus, worms, trojans and spyware programs, only report about them. For these you need to follow manual removal procedures documented on their web sites, or install a good virus scan program on your system.

If Virus or Trojans are blocking your access to scanners and preventing you from deleting their program files hidden in the temporary Internet files or the TEMP folder, then get and run DELINDEX from a boot diskette to remove their hidden and protected program and install files.

If you find an unknown program file being loaded in your startup list or a DLL being autoloaded, and suspect it is a Virus or Trojan not being detected by your Anti-Virus, you can have it scanned by most of the Anti-Virus data bases (impressive list) to determine if it contains a known virus. The web site VirusTotal.com provides this free service (En Español). Click "Browse.." button on their web page by "Select file" and locate the file on your system, and upload it to their server. It will scan the file and report the results. Plus send suspect files to the listed AV vendors for evaluation. Another such web site is Jotti's malware scan

Trojans are harder to detect, and the older and/or less common require specialized Trojan scanning programs. Normally only required in business networks, where the expense is justified. For home and small business scanning and blocking, TrojanHunter_$49 and a_squared_Personal_$40 are available. Run a free On Line TrojanScan to detect those not found by Anti-Virus and Spyware scanners.

Because the Browser Hijackers, like CoolWebSearch (CWS), and new virus change faster than removal tools like CWShredder, Spybot S&D, AD-Aware SE and Anti-Virus programs can be updated to remove them, it may be necessary for advanced users to learn how to detect them and manually remove them from systems. A useful tool for doing this is HijackThis.exe (by Merijn). It is a program tool to help you find and list all the Registry entries for BHOs (Browser Helper Objects) and Startup list programs, that might be used by Browser Hijackers, ADware, Spyware, Trojans, Worms and Virus. Create a C:\HJT folder and download HijackThis.exe into it. Then run the program. It will give you a list of all the program and BHO starting entries found on your system. This powerful tool will then allow you to select and remove any of these entries. The problem is determining which are normal entries that you need, and which should be removed. A tutorial on how to do this can be found at HJT Tutorial and has many links to help you use HijackThis and fix problems yourself.

To help you analyze HijackThis logs, if you just want an analysis that tells you what you must remove, cut and paste a copy your HijackThis log into the Help2Go Detective web page. It will tell you what you must delete and make additional recommendations on what has to be manually removed. You can also use Start - RUN - MSCONFIG - OK - Startup tab, to uncheck suspect entries, to test if they are part of the problem, or if they are needed programs. See Startups section for information on required Windows ME Startup programs and some that can and should be removed. You can also cut and paste the HijackThis log into the window on this German web page for an analysis of common entries and that points out the ones you need to look at. Be aware that this site's recommendations are only a guide and you must verify each of its recommendations before removing any program.

Once you have done what you can with CWShredder, About:Buster, Spybot S&D, AD-Aware SE, and virus removal tools, then with, a new HijackThis log saved, a list of what you have done and removed, and a summary of the remaining problems you are having, get free help at one of the many ASAP sites, like SpywareInfo forums. Do not post HijackThis logs, Spybot or Ad-Aware logs in any forum unless someone requests to see them.

Malware and virus can damage programs on your computer or leave it not working when they are removed. It may be necessary to repair parts of Windows ME, Device Drivers and applications.

If Internet Explorer, Outlook Express or Explorer has been damaged by hijackers, virus or other Malware, try to REPAIR with the IE service pack update files on your system. To REPAIR IE, go to Control Panel, Add/Remove Programs icon, and select (highlight) the entry for "Microsoft Internet Explorer ... and Internet Tools" and then click the Add/Remove button at the bottom of the window. In the options window, select the "Repair Internet Explorer" option and click OK. When it is done reboot the system.

If IE hangs at random times, or is sluggish, exit IE and delete suspect files in the C:\Windows\Download Program Files folder (except parts of installed programs like SUN Java), and reboot the system. New copies of Active-X scripts will download if required. Then go to Internet Options and under "Temporary Internet files", click the "Delete files" button. Then click Settings button and check the size of the TIF file area. With broadband you only need 10M to 15MB, and with Dial-Up, 20MB to 25MB. A large TIF area can make IE sluggish and provide a place for large ADware installers and Trojans to download into and hide.

If you can not run programs or access Control Panel functions due to damage from an infection, go to McAfee AVERT and download the Fixswen.inf tool, and then run or Install it.

If your connection to the Internet does not work after removing ADware/Spyware and Trojans, it may be because they modified the Networking support, WinSock.DLL or their registry entries. There are manual procedures to fix this problem and download programs to automate the fix. Download on working system and transfer by diskette to your Desktop, the Winsock2 Fix program W2Fix.exe (by Tom Knych). Then run it from the Desktop and follow instructions given. For advanced users there is the LSP Fix program.

A manual repair of Winsock2 support can be done quicker by going to Add/Remove Programs - Windows Setup tab - select "Communications" line and click Details button - uncheck "Dial-Up Networking" box and click Apply and then OK to remove it. Then check the box for Dial-Up Networking and click Apply and then OK again to install, exit and reboot to reinstall Networking support. This may require running the Internet Connection Wizard (in System Tools) to enable Internet connection again. Use the Windows Setup utility this way to repair or replace most of the optional parts of Windows ME listed in Windows Setup, if their files or registry entries are damaged or removed.

To repair or replace modules that are part of Windows ME, do not download copies from the Internet. Instead, EXTRACT them from the System CAB files stored on the disk drive in C:\Windows\Options\Install (or ..\CABS) folder, or from a Windows ME install CD (Win9x\*.CAB). Run MSCONFIG - "Extract file.." button and enter the file name. Then point to the folder with the CAB files and where you want it placed. Or you can use My Computer or Explore to open the *.CAB files, locate and right click on the file and select Extract option. Then use browse to point to the correct folder to put the clean copy of the file. If booting from a Startup diskette, use the DOS command EXTRACT and parameters to search the CAB files and locate the desired file. Point to the BASE2.CAB file and use /A and it will search through all of them. (Example of extracting ifshlp.sys and placing in Location C:\Windows folder: EXTRACT /A /L C:\WINDOWS\ C:\WINDOWS\OPTIONS\INSTALL\BASE2.CAB ifshlp.sys)

If your Icons and colors are not correct after removing Malware try the following. Boot system into Safe Mode, and then reboot back into Normal Mode (clears ShellIconCache). Then in Display Properties - Settings tab, set the "Colors" for 16 bit, 24 bit or 32 bit colors as allowed by your video adapter and drivers. Then set the "Screen Area" to your desired resolution, and click Apply.

If windows colors are not quite "right" and the active window title bar background color does not fade from dark on the left to light on the right, then try the following. In Control Panel click on the Accessibility Options icon (add it through Add/Remove Programs - Windows Setup tab). In Accessibility Properties click the Display tab. Place a check in the box "Use High Contrast", click Apply and OK to exit window. This will place your display into a white/black high contrast mode. Click Display tab again, remove the checked box and click Apply again, then OK. This causes Windows to reload all the registry settings for the current color scheme.

If you use MS WORD, a corrupted normal.dot control file can fill up your disk drive and cause System Restore problems. May cause errors in WINWORD. Search for and delete any copies of "normal.dot". WORD will rebuild a new one.

To help make yourself aware of background processes starting, ending or aborting, go to Control Panel - Sounds and Multimedia Properties - Sounds tab and select the "Program Start" and "Program Close" events and enable different event sounds, and Apply it. Now every time a program starts, closes or aborts you will hear the sounds, and alert you to possible problems you were not aware of.

To understand what tasks and programs are running on your machine, may be causing problems and taking up the processor bandwidth, download WinTop, one of the free Micro$oft Kernel Toys. It gives accurate %CPU idle time and usage by program.

Windows 98/ME has several unfixed bugs that effect kernel usage measurement tools that monitor the "idle" processor time Registry information. It will show 100% usage if two programs monitor idle usage. Examples include MS Bookshelf and Encarta, MS ACCESS, most kernel monitoring tools and applications that attempt to monitor processor usage by accessing the Registry "idle" process counter. Even Windows NT/XP idle usage has problems in this area. In addition some Windows 98/ME systems enter a state where the "idle" processor usage indicator becomes unstable, but performance is not really effected. Reported in both Windows 98 and 98se, Microsoft did not consider it important enough to bother to fix in Windows ME. Sometimes rebooting resolves if for a short period of time, but the only fix is to format and reinstall Windows with a clean Registry. Because of these problems, the WinTop tool is highly recommended as it calculates its own "idle" processor time instead of attempting to use the unreliable Registry counter.

Use the Windows ME System Tools - System Information utility, expand "Software Environment" and look at the "Running Tasks" and the "Loaded Modules", to find all programs running and all programs, DLLs and Drivers loaded into memory. And run "Explorer /e" to view all folders and hidden files.

(Note: The Microsoft Kernel Toy TweakUI should not be used with Windows ME. See TweakUI causes problems with Windows ME. There are many problems caused by TweakUI documented by Microsoft Support.)

CPU-Z is a great utility for getting accurate information about your processor information and speed, cache size, FSB and Memory speed, system board and chip set information. CPUZ.exe is updated frequently as new processors are released.

MS PAINT on a default Windows ME install can only view and save files in BMP (Bit Map) format. When other Microsoft applications like Office or Word are installed, optional "Filters" can be installed that allow Importing and Exporting in JPEG and GIF file formats. While these additional formats can only save in 256 color mode, MS PAINT is still a useful tool for creating icons and editing small images. But when MS Word/Office service packs are installed these additional "Filters" may no longer work. To FIX this and add Filters to import a long list of image file types into MS PAINT, install this ZIP package of Filters. Expand or copy its contents into the folder: C:\Program Files\Common Files\Microsoft Shared\Grphflt. Create the Grphflt folder if necessary first. Then browse to the folder and run the GRPHFLTS.REG file to register all the DLL and Filter files. Then start PAINT.

For accessing NTFS drive volumes (NT/XP disk partitions) from a Windows ME startup up diskette, download NTFS DOS reader (by Mark Russinovich & Bryce Cogswell) and copy the NtfsDos.exe program to your startup diskette. Then run it from the A:\ command prompt to check for and attach NTFS volumes in read-only mode. To access NTFS volumes in read-only mode from Windows, install NTFS-reader.

The easy fixes for Windows ME is to remove default startup programs that are not needed. But first:

Install the Windows Updates and Security patches! Go to the Windows Update site and install all of the Critical Security updates for ME and IE. (You can skip the Windows Media Player 9, the .NET, the Multi-Language Features updates and the Device Driver updates.)

It is recommended that you disable Anti-Virus and Firewall programs during the install of Windows Updates, to prevent problems. System Restore should be enabled during updates.

If you have a slow Internet connection, see Windows ME Update List about using the Microsoft Download Center and Windows Update Catalog to download large Windows ME updates on a system with a fast connection and save them on a CD-R. The free Critical Updates CD from Microsoft is no longer available! Microsoft has extended Windows Update site support for Windows 98/98se/ME until June 30, 2006.

If IE 6.0 sp1 is not installed, there is a recommended update (patch) on the Windows Update site for the Internet Explorer Navigation Sound (click) that is needed to avoid random hangs when using older versions of IE. This patch or IE 6.0 service pack 1 is required. The Automatic Updates fix and System Restore fix must be installed to avoid system slowdowns and hangs. These three fixes should be installed first.

When upgrading to Internet Explorer 6 SP1 with Dial-Up, Open IE6 SP1 setup program and run it, select the Minimal or customize option. Next window click Advaced.. button, then select Download Only. Save it in its own folder. Then reboot, disable Anti-Virus and Firewall, and do the install. You can run it again any time or copy this download folder to CD to save.

Download the DirectX 9.0c Redistributable package and save it. This large 34MB download can then be ran to create a work folder with the setup files in it. Run the Setup program from this folder off line and after disabling Anti-Virus program to avoid problems that can occur while on line.

The following Windows Windows ME Fixes

remove some of the default installed Windows ME modules that are known to cause problems (and are not needed). Also checks for and fixes common Windows ME Startup problems. You should then update all of your systems hardware device drivers as there are many fixes in newer versions provided by the hardware chipset makers.

To make Windows ME more stable, resolve some problems with Winmgmt stalling system and allow ScanDisk and Defrag to run without restarts, it is important to remove two Windows ME Startup tasks (PCHealth and TaskMonitor) that often cause system performance problems, hangs and restarts.

Use (Start - RUN - msconfig - OK, Startup tab) to un-check PCHealth and TaskMonitor from your active Windows ME startup list. They are not needed and can be removed. PCHealth only collects system configuration change information, for use in remote problem analysis by Enterprise Network $upport desks (WBEM/WMI). Is your company paying for that kind of remote on line support? TaskMonitor collects information on what parts of programs are being loaded and its scheduled task Tune-UP uses it to tell Defrag which 10 programs to leave fragmented. Drives are fast and you do not need this minor tweak for loading a select few programs, one time. Un-check the "show message box" when the system boots. Once this is done, reboot and go to System Tools - Scheduled Tasks and delete the icons for PCHealth and Tune-UP applications, the second part of these programs, again unneeded. Programs will load a little faster, the disk drive has to work less, Defrag and ScanDisk will not restart as often and your system will be more stable.

After you have tested this change, you can remove these two items from the MSCONFIG startup list. One way is to locate their RUN- entries in the system Registry with REGEDIT and delete them. Or use the HijackThis program. To do this, enable them with MSCONFIG and allow the system to reboot. Then run HijackThis program and locate the entries in the Scan list, check them and FIX. After rebooting, verify they are no longer in the MSCONFIG Startup tab list, then go through the procedure to remove their entries from the Scheduled Tasks list again.

Remove SSDPSRV which slows down the system and leaves port 1900 and 5000 open, as part of the unused "Universal Plug and Play" feature. Go to Start - Settings - Control Panel - Add/Remove Programs - Windows Setup tab - select Communications - Details - and un-check "Universal Plug and Play". Click OK, OK, then Restart system. FYI why. It also causes random hangs and slowdowns when connected to the Internet or a Network. It can also be remove by un checking its entry in the Startup list.

If your System _RESTORE files are corrupted, contain disabled virus or has grown too large, it can cause system slowdown problems. It is also very important that the Critical System update patch for System Restore be installed from the Windows Update site as the ship version no longer restores files created after September 8, 2001 and can cause system slowdowns. Often the STMGR.exe task will start running at 50% or more in the background. This can be corrected by Disabling System Restore and then re-enabling System Restore, to delete all the old restore points. Go to (Start - Settings - Control Panel - System - Performance tab - File System - Troubleshooting tab), and check the box for "Disable System Restore", click Apply and exit. System will reboot. Allow STMGR time to delete all the old system restore files, wait for no disk activity for at least a minute. Then run DEFRAG on the drive. Next go back into the Troubleshooting tab and un-check the box to enable System Restore again.

Next use the Hard Disk tab to set the "System Restore disk space use:" slide bar to only use about 900MB (or less) of disk space to limit how much of the drive it might use. Also change the "Typical role of this computer:" to the Network Server option for better performance. - - Make sure system is up to date on the Windows Update site, and this old fix for System Restore is installed.

In extreme cases of corruption of the System Restore folder files, it is necessary to boot with a Windows ME Startup diskette and use the DOS command DELTREE C:\_RESTORE to remove the folder. If there are a large number of files in the folder, speed up the DOS delete by starting SMARTDRV first.

If you are not able to set System Restore checkpoints, Q274092 recommends checking for a C:\Windows\Wininit.INI file left over from a failed program install and deleting the WININIT.INI file if found.

To avoid system slowdowns after logging on to the Internet, disable Automatic Windows and IE updates. Again, if their files are corrupted it can cause system slowdowns, hangs, or the mouse to freeze for 3 seconds every five minutes. Go to Control Panel - Automatic Updates and under Options, set "Turn off automatic updating. I will update my computer manually." Check this every so often as Windows will turn it back on sometimes. Then in Internet Explorer, click Tools - Internet Options line - Advanced tab, and un-check the box "Automatically Check for IE updates" and then click Apply. Use the Windows Update site to update manually. On the Windows Update site, there is an update for the Automatic Update program. Make sure you install this update (WuCrtUpd), to replace the built-in version that has many problems, and then go back to the Control Panel and Turn off automatic updating again. Trying to do automatic updates in the background can kill Dial-up performance, and you have to disable automatic updates in both places.

If Internet Explorer has become sluggish and hangs a lot, use DELINDEX to remove the Temporary Internet Files (TIF) that may be corrupted. Or the CCleaner application.

If Internet Explorer starts hanging for one minute on some web pages before allowing you to continue and forces you to reboot to clear the problem, and you have Apple's Quick Time installed, delete the "Quick Time Task" entry in MSCONFIG Startup tab and then delete the C:\Windows\System\QTTASK.exe file. Started at boot time to run .MOV (Movie) files within IE, it can start causing all open IE windows to hang for one minute at a time. Not required if you do not frequently run Movie files from within IE.

Disable Windows critical update checking

Next go to Control Panel - Add/Remove Programs and look for "Critical Update Notification". If found, Disable it from starting. See AnswersThatWork - WUCrtUpd.exe. It can cause your system to check the Windows Update site every five minutes when on line. On some systems, removing this can cause the Windows Update site to show this Critical Update as not installed. In this case you either have to not install it again, or you can install it, and just delete the Critical Update notification WuCrtUpd.exe entry in the Startup list with MSCONFIG and its entry in the Scheduled Tasks.

Slow system performance just after booting up and/or just after connecting to the Internet or a Network can be caused by the default setting for NetCrawl. NetCrawl is a Windows ME feature that searches for Network Shares of servers and printers. See MS_Q256248. If not connected to a network or if you never connect to a network server or printer, this function can be disabled. See MS_276322 or in "My Network Place", Tools, Folder Options, View tab, un-check the "Automatically search for network folders and printers" and click "Apply". This setting can require you to manually connect to local network resources.

During Shutdown, if system hangs for 15 seconds with a black screen and a cursor in the upper left corner, check in Network Properties, "File and printer sharing for Microsoft Networks" component properties for the "LM Announce" feature set to "yes". This causes a 15 second delay shutting down while the system announces to the network that it is leaving. Unless your system is being used as a file and printer server on a large network this should be set to the default NO.

If you have Micro$oft's Office installed and have slow disk access problems, use Kill Fast Find MS_158704 procedure to disable the problem causing Fast Find function, and leave it that way.

If your system hangs while you are a way from it, it could be due to default Power Management settings, which are a problem with Windows ME. To disable Hibernate, in Control Panel - Power Options - Hibernate tab, un-check the "Enable hibernate support" option. Then on the Power Schemes tab, make sure the "System Stand by" option is set to Never. It is also recommended that you go into the systems BIOS CMOS Settings and under Power Management Setup disable "ACPI function" and "PM control by APM".

If system slows down and System Resources drop after running System Information or HELP, check Task Manger (Alt-Ctrl-Del) for WinMGMT running. Or if you use Adobe Reader to view a PDF document from inside IE and exit, check for ACCORD32.exe still running. They do not always exit when they should. Starting and exiting Adobe Reader will close ACCORD32.exe. Use Task Manager or WINTOP to select Winmgmt (or ACCORD32) and End Task. Remove PCHealth from Startup and Scheduled Tasks to help avoid Winmgmt starting. Adobe Acrobat Reader 6.0 sometimes causes slowdown problems and hangs on Windows ME systems. First try version 6.0.1 and do the on line updates to version 6.0.2 and later updates. If necessary install the older Version 5.1 (13.7MB) as it works much better with Windows ME. Another option if you do not use Adobe Reader to fill in forms, remove Adobe Reader and install an alternate PDF reader like Foxit Reader.

If your "New - Folders" option does not list "Compressed Folder" then you do not have Windows ME support for ZIP files enabled. (Disabled in some custom installs of Windows ME.) In Control Panel, Add/Remove Programs, Windows Setup tab, select System Tools line and click Details button, make sure the Compressed Folders option is checked. Click Apply and exit. This option supports ZIP files and folders and allows you to avoid Spyware/Malware that comes with some ZIP programs. You can create ZIP folders and password protect them, copy files into them and then treat the folder as a ZIP file (which it is) and send it. Allows you to Extract ZIP file contents from downloaded file, Explore ZIP file contents with My Computer just like a normal folder, or even execute some programs directly from the ZIP files. If you have a large number of seldom referenced text or compressible files, you can create a Compressed Folder for them and move them into it. This will save disk space. See MS 272996.

The LexMark Z, A & P series printer drivers cause random program and shutdown hangs. If not sharing Lexmark printer to the network, one of it's problem drivers can be removed without effecting normal operation. Rename or delete the file \Windows\System\Lexpps.exe using Safe Mode or a boot diskette DOS prompt. The file, Lexpps.exe, may also exist with some low end HP and Compaq printers that were OEM'ed by Lexmark. See AnswersThatWork - Lexpps.exe. For older LexMark printers, like the Z42, you can also remove Lexstart.exe from the Startup tab list with RUN - MSCONFIG utility, (keep LexmarkPrintTray). Test to see that removing it does not cause printer problems with your model.

Do not remove or un-check ScanRegistry, SystemTray, and *StateMgr from the MSCONFIG - Startup tab list. They are required for normal operation of a Windows ME system. All others can be un-checked in MSCONFIG - Startup tab when diagnosing problems.

Name	Module	Provider
AVG7_AMSVR	AVGAMSVR.exe	Grisoft AV
AVG7_CC	AVGCC.exe	Grisoft AV
AVG7_EMC	AVGEMC.EXE	Grisoft AV
AVG_RegCleaner	AVGREGCL.exe	Grisoft AV
AVPCC	avpcc.exe	Kaspersky AV
ccApp	ccApp.exe	Symantec AV
ccEvtMgr	ccEvtMgr.exe	Symantec
ccRegVfy	ccRegVfy.exe	Symantec AV
KAVPersonal50	Kav.exe	Kaspersky AV
kavsvc	kavsvc.exe	Kaspersky AV
McAfeeVirusScanService	AVSYNMGR.EXE	McAfee AV
McVsRte	mcvsrite.exe	McAfee AV
MPFExe	MPFTRAY.EXE	McAfee FW
OfficeGuard RegChecker	ogrc.exe	Kaspersky AV
PCCClient.exe	PCCClient.exe	PC-cillin AV
pccguide.exe	pccguide.exe	PC-cillin AV
PCCIOMON.exe	PCCIOMON.exe	PC-cillin AV
PCCPFW	PCCPFW.exe	PC-cillin FW
Pop3trap.exe	Pop3trap.exe	PC-cillin AV
ScriptBlocking	SBServ.exe	Symantec AV
SmcService	SMC.exe	Sygate FW
TrueVector	VSMON.EXE	ZoneAlarm FW
VsecomrEXE	VSEcomR.EXE	McAfee AV
Vshwin32EXE	VSHWIN32.EXE	McAfee AV
VsStatEXE	VSSTAT.EXE	McAfee AV
Zone Alarm Pro	Zapro.exe	ZoneAlarm FW
Zone Labs Client	zlclient.exe	ZoneAlarm FW

It is important to update all your hardware device drivers with the newest Windows ME specific drivers. (System board chip set, Video adapter, Ethernet card, modem, sound, Printer, etc.) The default Windows ME drivers are too old and do not work with new adapters. USB 2.0 adapters require updated USB drivers. Often the drivers that come with older adapters or system boards have bugs and are not Windows ME specific, and often cause delays or hangs when shutting the system down. Use Device Manager and System Information tool to help identify chip sets used and their ID numbers. Look on your system and attachment manufactures web sites for updated Windows 98/ME drivers first. Belarc Adviser can also be used to identify what hardware your system has and what drivers are installed. Use Device Driver updates from the Windows Update site only as a last resort.

To really clean out unneeded Windows ME temp files, the IE temp folders, cookies and index files (which have a history of every web site you have visited), corrupted work files, and left over Malware files, get a copy of the DELINDEX.BAT (by Renaissance Man) and place it on your C:\ drive. Then boot from a Windows ME Startup boot diskette and run the batch file per its instructions. It will clear out INDEX.DAT, files junk and free up disk space, so that the system and IE can run better. DELINDEX v5.1 now has a option for making a custom fast boot and run diskette. Be aware that this utility deletes all cookies, some of which may contain the passwords you use to automatically access specific web sites. You may want to save copies of these cookies in a folder and have DELINDEX restore them for you.

An installable Windows application program that does much the same thing as the older DELINDEX.bat DOS procedure for Windows 98/ME is CCleaner. It can be installed and allows a wide range of selectable options on what to clean up. Requires that you reboot the system after running to complete the clean up process.

If you still have random hangs and shutdown problems or other specific problems, and all else has failed to help, try using Micro$ofts procedures for trouble shooting Windows ME Shutdown Problems. Treat "your problem" as the shutdown hang and use those procedures to isolate what may be causing it.

Keep in mind that most Shutdown hang problems are caused by backlevel hardware device drivers, and that you need to update all of them to the latest Windows ME compatible drivers. But, any application program, including hidden Malware, that hangs can also cause a Shutdown problem.

Special note: Cisco released firmware updates for their Linksys BEFSR11, BEFSR41, BEFSR81, & BEFSRU31 routers (6/24/2004) to fix a security problem known as the DHCP Server and BOOTP Packet Vulnerability, and minor fixes 8/3/2004. Adds the "adaptive IDENT" for port 113 feature (found in the ZoneAlarm Firewall) as a new (disabled by default) Filter IDENT(port 113): option (stealth mode), that should be manually enabled after updating. See: Linksys Support. Verify that "Block WAN Request:" and "Filter IDENT(port113):" are Enabled, and that "Multicast Pass Through:", "IPSec Pass Through:", "PPTP Pass Through:", "Remote Management:" and "Remote Upgrade:" are all Disabled.

Join the DShield watch. If you have a router that supports SNMP/syslog or a firewall, and your system is connected 24/7, then join the DShield watch and send your daily router logs in to be included in the SANS Internet Storm Center data base. For more information see DShild.org.

		Windows ME Fixes
	By:	..Jack Gulley..	ver 2006/04/2