Small annoyance, advice needed please.

[Cochise]

Hi All,
Just installed new "Trust" 360B Easyscroll keyboard and 5 button wireless Mouse.

Installation went without a hitch, but, from out of nowhere, when I boot up I get a message (White letters on a black background) after the first of the M$ flying logos that states:-

"A device file that is specified in the SYSTEM.ini file is damaged. It may be needed to run Windows.
You may need to run the Windows setup program again.
If the file is included in another Software package, you may need to re-install the software that uses the file,
C:\windows\system\msmouse.vxd.
Press a key to continue"

Once I press any key it boots up as normal.
Whatever this is, it is not affecting my OS in anyway whatsoever and I cannot find out what or where this file is and consequently I don't seem to be able to get rid of it.

I thought maybe Windows or Wilders File Checker might find and repair it but I can't seem to find either of them.

I've run Scandisk and defrag, Scandisk found nothing!!!
Any contributions gratefully received.

TIA Cochise 8)

OS. Win 98se, 550Megs, 30Gbs, 128 RAM.

[Pieter_Arntz]

Hi Cochise,

Windows 98, right?

Have a look here (http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/Q140/4/41.asp&NoWebContent=1) on how to remove the mouse= line from your system.ini
Don´t forget to make a backup of the original!! ;)

Regards,

Pieter

[Cochise]

Me again Pieter,

Just before I go off and take your advice.

I have a multi-search engine installed so I thought, out of interest, to type in:-

C:\Windows\System\MSMouse.vxd.

The answers that were returned all seem to point to a Trojan called "Zeraf"?????

Do you think that could be a possibility please and if so what action would you suggest?

I have AVG, Adaware, Spybot S&D and Spyware Blaster, but I don't have a Trojan Snuffer.

Your kind input would be appreciated or anybodies input for that matter.

TIA and Best Regards to all, Cochise. 8)

[Dan Perez]

Hi Cochise,

If you do a search for just "msmouse.vxd" you will find that this is also the legitimate name for the default mouse driver in 98 and ME. Given that the issue only started occuring on the install of another mouse I would say you have nothing to worry about on this.

HTH,

Dan

[Cochise]

Cheers Dan Perez,

Thanks for your rapid response, don't get me wrong Mate, but it's not so much whether it's a Trojan or what, it's just the annoyance of having to press a damn key everytime just to continue to boot up, I just want rid of the message, you know the feeling, LOL.

I will continue to hunt down the offending little tick until it's GONE!

Cheers and Thanks to all, Cochise. 8)
PS. See, I'm still smiling :D

[HKLM]

From the MSKB:
Q140441 - Creating a New System.ini File Without Third-Party Drivers

Default Entries for the System.ini File
The following entries are the default entries for a new System.ini file:

[386Enh]
device=*vshare
device=*dynapage
device=*vcd
device=*vpd
device=*int13
keyboard=*vkd
display=*vdd
mouse=*vmouse, msmouse.vxd
woafont=dosapp.fon
device=*enable

It is an entry in the system.ini and it's used as a default entry therefore you probably dont want to remove this line.

From the Warning windows displays when you start your PC (and since you have found that a trojan with the same name exists) you can try to replace the file msmouse.vxd using sfc.exe (System File Checker) to extract the original file from the windows installation CD using the option-->Extract one file from installation disk

If you want to know if a file (like msmouse.vxd) is from the original windows installation or it has been replaced (by a trojan) with another file with the same name you should install the Microsoft Windows 98 Resource Kit Sampler from the Windows 98 CD (X:\tools\RESKIT) and use the FileInfo tool.

You should also search the registry (after running MRU-blaster) for the case there is also an entry in the registry.In my case there is only a binary value "msmouse.vxd" under the key:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\InstalledFiles\

This is how the original file should be: