# system restore in windows me plz help



## notredame888 (May 19, 2002)

i have windows me and from what i have been reading by default in windows me system restore is supposed to be enabled. however it is disabled on my pc. when i go in to uncheck disable system restore it says resart for changes to take effect so i do and when it reboots it is still disabled. the reason i am asking this i dont think i have a virus but i have been getting them sent to me and they go to quarantine. but to test for sure i am trying to run the removal tool and it tells me "the tool has detected that system restore is enabled plz disable it before continueing". again according to my pc it is disabled and will not even let me enable it. any thoughts on the what my problem might be?


----------



## Rollin' Rog (Dec 9, 2000)

How much free space is available on your hard drive? I'm wondering if you are encountering a version of this problem:

http://support.microsoft.com/directory/article.asp?ID=KB;EN-US;Q261680&


----------



## notredame888 (May 19, 2002)

according to my computer is says used 8.27gb and free 20.2gb im ont sure if that is waht u mean or not though so let me know. thanks


----------



## Rollin' Rog (Dec 9, 2000)

I'm going to PM one of our moderators who has WinME and see if he can unravel this for you. You certainly have plenty of disk space, and I just don't know of any reason why you should be getting conflicting messages like that. Have you done a full system scan to see if you have any infected files other than in quarantine? If they are klez related, at least they will be identified if not removed.

In the meantime it might help to have look at what is running at startup, we can tell to some extent if you have an active klez infection by the startups. Go to Start>Run and enter *msinfo32* Click Software Environment, then Startup Programs. Then click Edit>Select All>Edit>Copy and paste the copied text to a reply.


----------



## notredame888 (May 19, 2002)

well here you go i think i did it alllike u said


AIM	c:\program files\aim95\aim.exe -cnetwait.odl	.DEFAULT	HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
CSINJECT.EXE	c:\program files\norton systemworks\norton cleansweep\csinject.exe	All Users	HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
Microsoft IntelliType Pro	"c:\program files\microsoft hardware\keyboard\speedkey.exe"	All Users	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
MiniLog	c:\windows\system\zonelabs\minilog.exe -service	All Users	HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
NAV Agent	c:\progra~1\norton~1\norton~2\navapw32.exe	All Users	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Pop-Up Stopper	"c:\program files\panicware\pop-up stopper\dpps2.exe"	All Users	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
QD FastAndSafe All Users	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ScanRegistry	c:\windows\scanregw.exe /autorun	All Users	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SchedulingAgent	mstask.exe	All Users	HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
ScriptBlocking	"c:\program files\common files\symantec shared\script blocking\sbserv.exe" -reg	All Users	HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
SystemTray	systray.exe	All Users	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
TrueVector	c:\windows\system\zonelabs\vsmon.exe -service	All Users	HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
Weather	c:\program files\aws\weatherbug\weather.exe 1	.DEFAULT	HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ZoneAlarm	c:\progra~1\zonela~1\zoneal~1\zoneal~1.exe -nopopup	All Users	Common Startup


----------



## Rollin' Rog (Dec 9, 2000)

Well the good news is I don't see any indication of an active Klez infection (or any other) from that list of startups. The bad is I still don't know what's up with System Restore, unless there is some possible conflict with Norton's Cleansweep.

But have patience, it may be a day or so before Davey, our WinMe empowered Moderator picks it up, although others may well want to contribute any thoughts they may have.


----------



## notredame888 (May 19, 2002)

ok thanks so much for trying to helpme out ill be patient and wiat for my email saying i have a post thanks again


----------



## Rollin' Rog (Dec 9, 2000)

Looking at your startups again, it occurs to me that what I'm not seeing may be more important than what I so see.

I don't see the typical WinME entries for *statemgr and PCHealth.

Go to Start>Run and enter *msconfig*
Look under the Startup tab and see if they are present and UNchecked. If so Check them and see if you can then enable/disable System Restore.


----------



## notredame888 (May 19, 2002)

ok i did find pchealth in there and it was unchecked i checked it. statemgr was not in there. i tried to enable system restore by unchecking disable system restore then had to reboot but when i got back there it was still checked as disabled. i wonder if there was other things in there that i unchecked because at one time i disabled alot of stuff in there. do you think i should check the one that says load everything from startup and try it then?


----------



## Rollin' Rog (Dec 9, 2000)

I think the absence of the *statemgr entry under msconfig> startup is the key to this. But we should wait for more WinMe knowledgeable advice. I don't know whether the entry is removed if System Restore is disabled or whether one should expect to see it there but unchecked.


----------



## Mosaic1 (Aug 17, 2001)

Rog,
I used this site when researching similar issues. I think you are correct. Have a look.

http://users.iafrica.com/c/cq/cquirke/sr-sfp.htm


----------



## notredame888 (May 19, 2002)

ok ill wait for you thanks


----------



## Preston Tyson (Apr 18, 2002)

You can also do a system restore from DOS
____________________________________
How to Start the System Restore Tool From a Command Prompt (Q279736)

----------------------
The information in this article applies to:


Microsoft Windows Millennium Edition 


----------------------


SUMMARY
Windows Millennium Edition (Me) includes the System Restore tool, however, you cannot start the System Restore tool from a command prompt. Because of this, it may be useful to start the System Restore tool when you are unable to start your Windows Me-based computer normally or in Safe mode. This article describes how to start the System Restore tool when you are unable to start your Windows Me-based computer normally or in Safe mode. 


MORE INFORMATION
To start the System Restore tool when you are unable to start your Windows Me-based computer normally or in Safe mode, you can temporarily change the Windows shell from Explorer.exe to Progman.exe: 

Start your computer by using the Windows Me Startup disk. 


At the Startup menu, choose Minimum Boot . 


At the command prompt, type edit c:\windows\system.ini , and then press ENTER. 


Edit the shell= line so that it looks like this: 


shell=progman.exe 
Press ALT+F, and then press S to save the changes to the System.ini file. 


Press ALT+F, and then press X. 


Remove your Windows Me Startup disk, and then restart your computer. When your computer restarts, Program Manager should start. If Program Manager does not start, repeat steps 1-7, being careful to follow these steps exactly, and then continue to the next step. 


On the File menu, click Run , type msconfig in the Command Line box, and then press ENTER. 


Click Launch System Restore to begin restoring your computer to a previous, functional state. 


NOTE : After you configure your computer to start Program Manager, you can start the System Restore tool by typing c:\windows\system\restore\rstrui.exe at a command prompt, and then pressing ENTER. 

For additional information about the System Restore tool, click the article number below to view the article in the Microsoft Knowledge Base: 
Q267951 Description of the System Restore Utility in Windows Me


----------



## notredame888 (May 19, 2002)

currently when i try to launch system restore it says "system restore is unable to protect your computer. please restart your computer then run system restore again" however that doesent work either


----------



## Davey7549 (Feb 28, 2001)

notredame888
Seems you have a missing *statemgr for some reason. Lets see if you have it onboard. Go to Start\Search and type in *statemgr and hit enter. It should be located in the C:\Windows\System\Restore folder if it is not then it will have to be extracted, if it is located anywhere other then the mentioned folder then copy to that folder. If it is not onboard at all then go to start\Run and type in MSconfig and hit enter. Once screen appears then click the Extract button and select *statemgr and have the system look in the C:\Windows\Options\Cabs folder for it and place it in C:\Windows\system\restore folder.
Now the next step will be to get the run line in the registry.

Dave

Edit: Changed C:\Options\Cabs to C:\Windows\Options\Cabs
Sorry about the mistake.


----------



## Mosaic1 (Aug 17, 2001)

notredame888,


Dave asked me to post this registry file for you. Once you get *statemgr into the correct folder, you will need to have it run at start. This should do it for you. I am attaching a file named

Runservices.txt

Download it and rename it Runservices.reg

Double click to enter into the Registry. This will add it to your startups. 

Mo


----------



## bandit429 (Feb 12, 2002)

I have a question. Is it possible that statmgr became quarintined because the machine created an automatic restore point that was infected?


----------



## Rollin' Rog (Dec 9, 2000)

Bandit, no, the antivirus programs don't quarantine *statemgr, at least not for having infected files in System Restore. Those are identified as uncleanable and the user must be aware of the need to purge them manually or just not use System Restore until they are bumped out automatically.


----------



## notredame888 (May 19, 2002)

davey, i did what u said below restore from C:\Windows\Options\Cabs and save file in C:\Windows\System\Restore when i clicked ok it said "the file was not found. verify you have entered the correct restore from folder and try again. that is as far as i got



> _Originally posted by davey7549:_
> *notredame888
> Seems you have a missing *statemgr for some reason. Lets see if you have it onboard. Go to Start\Search and type in *statemgr and hit enter. It should be located in the C:\Windows\System\Restore folder if it is not then it will have to be extracted, if it is located anywhere other then the mentioned folder then copy to that folder. If it is not onboard at all then go to start\Run and type in MSconfig and hit enter. Once screen appears then click the Extract button and select *statemgr and have the system look in the C:\Windows\Options\Cabs folder for it and place it in C:\Windows\system\restore folder.
> Now the next step will be to get the run line in the registry.
> ...


----------



## Davey7549 (Feb 28, 2001)

notredame888
Truely sorry about all the mistakes in my correspondence of last night but I was extremely tired from an all day fishing trip taking to Seven Year olds out!
Anyway the the executable we are looking for is Statemgr.exe not *statemgr. So review through your search and see if that is present in the C:\Windows\System\Restore folder......If not extract it using the same process.

Dave


----------



## notredame888 (May 19, 2002)

lol ok np davey i appreciate all your help ok it successfully extracted. now i double clicked the thing that i belevie mosaic told me to click to add it to my startup but i didnt get the option to rename or anything here is what happened . so not sure what to do next.

"REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"*StateMgr"="C:\\WINDOWS\\System\\Restore\\StateMgr.exe"


----------



## Davey7549 (Feb 28, 2001)

notredame888
Try right clicking the text file and select rename. 
Rename it Runservices.reg and hit enter
System will prompt are you sure and click yes.
Then double click to merge into registry.

Dave


----------



## Mosaic1 (Aug 17, 2001)

One quick thing. You seem to have added
a quotation mark to that reg file.

"REGEDIT4
Be sure that isn't there or the file will not be recognized as a registry file.
That was not in the original file. I am hoping you just had a typo.
It should be 
REGEDIT4


----------



## notredame888 (May 19, 2002)

ok im lost again sorry. mosaic yeah that was a type o i copy and pasted that there and put the " in. 


davey i dont quite understand what u mean about rename the text file


----------



## Davey7549 (Feb 28, 2001)

notredame888
In a previous post Mosiac attached a text file. Download that text file in its entirety to you desktop.
Close all Apps back to Desktop. 
Step 1- Right click RunSevices.txt and select rename
Step 2- Rename the file RunServices.reg
Note: system will prompt do you want to change...say yes
Step 3- The file Icon will be changed to one with Building blocks on it.
Step 4- Double Left Click the RunServices.reg file
Step 5- System will prompt for merge........Say yes
Step 6- After Merge Go to Start\Run and type in MSconfig and enter
Step 7- Once at MSConfig Select the startup tab
Step 8- Scroll to *Statemgr and make sure it is selected....Should be.....If not select and Click Apply, Then OK
Step 9- Restart System
Step 10- Try creating a Restore point now.

Dave


----------



## notredame888 (May 19, 2002)

when i click the file to download it goes lighting fast and does not give me the option to save to desktop i see the box for a split second then it takes me to a new window and has text below i pasted it in below

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"*StateMgr"="C:\\WINDOWS\\System\\Restore\\StateMgr.exe"


----------



## Mosaic1 (Aug 17, 2001)

Use Find files to find it.

Or go to the link to the attachment in my previous post. Right click on it and choose Save Target As. You will be able to choose the download location and rename it. This method brings up a dialog box for you.


----------



## notredame888 (May 19, 2002)

nm my last post davey im an idiot lol. ok statemgr is in my startup and is selected now i am going to try to restart and try the system restore then ill let you know thanks alot


----------



## notredame888 (May 19, 2002)

dang this sucks. it still wont work i unchecked disable system restore restarted and when i went back there it is still checked as disabled. for ****s and giggles i tried to launch system restore and it said same thing system restore is unable to protect your computer restart and try again. i got an idea maybe i can throw my pc out the window do u think that might help lol


----------



## Davey7549 (Feb 28, 2001)

notredame888
Throwing out the Window is not an option yet. Lets get all in order here. Go to Start\Settings\Control Panel\System Once there click the Perfomance Tab and select "File System" 
Set your System Restore Slide bar to minumum and click Apply, Then OK.
While still there go to the troubleshooting section and uncheck disable System Restore, Click Apply, Click OK.
Then Restart System.

Do those things and then see. There are other items yet to do but do those first.

Dave


----------



## Rollin' Rog (Dec 9, 2000)

Do a file Search for *wininit.ini*

This is a file that is used during updates and should be deleted automaticlly after completion. If it remains on the drive, it can prevent System Restore from running.

If you find it either rename it to wininit.bak or delete it.

Be Careful that you do not mistake wininit.exe for it. This file must not be touched.


----------



## notredame888 (May 19, 2002)

o files found when i searched for wininit.ini


----------



## notredame888 (May 19, 2002)

sorry if i dont reply for awhile have to go do the family memorial day thing i will be back later this evening thanks again for all your help


----------



## Davey7549 (Feb 28, 2001)

notredame888
After you have done the above suggestions and if it still is disabled then go to this registry folder and Export to desktop naming it policies. Rename file at desktop to policies.txt
Then attach that file to a post here.
Dave

Registry location
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]


----------



## notredame888 (May 19, 2002)

ok if this makes sense as far as i can get in the registery is under "hkey_users" i can get all the way to current version when i open that folder the only other oprion i have is called telephony.

then under "hkey_current_config" the farthest i can get is also to current version then my only other option is internet settings.



i put both of these down because u said hkey_current_user and i dont have one of them i only have the two mentioned above. hopefully i described all that to u ok


----------



## Mosaic1 (Aug 17, 2001)

You are in the wrong place. 

I am attaching a gif of the registry when you type regedit and press enter. 

You say you do not have 
HKEY_CURRENT_USER 

That is not possible. Unless you have a problem with regedit.exe

You might want to extract a fresh copy of regedit.exe from the cabs to C:\windows 

Have a look at the atttachment.


----------



## notredame888 (May 19, 2002)

u are right i typed regedit without the exe now i am in the right spot i am all the way to the explorer folder but i dont know how to export it to the desktop like davie was asking me to do?


----------



## Mosaic1 (Aug 17, 2001)

Highlight the key you want to export. then go to the toolbar>registry>export registry file and click it. A dialog box will appear. Name the fie and save it on the desktop or wherever you like. Then rename it as a txt file and attach it to a post.
Here's a screenshot.


----------



## notredame888 (May 19, 2002)

ok guys im sorry it took so long for me to reply been very busy til this evening i attatched the file like u asked so here ya go just let me know if gave u all the info that u asked for. them screenshots helped out alot thank you. i didnt have any clue what u were talking about lol till i looked at them on the screenshot


it will not let me attach the file? i renamed it policies.txt and it still will not let me it says invalid attachment or something let me know what to do


----------



## Davey7549 (Feb 28, 2001)

notredame888
Not sure why you have a problem attaching a .txt file.
Double check and make sure the name is Policies.txt and when you are in the post section, creating a new post to this thread, look below the typing field for attach file. Use the browse button to locate where you have stored the Policies.txt file, highlight it and then and then click open, it will appear in a long string in the attached file window. Once you send the post the file will be retrieved from your system and attached.

Dave


----------



## notredame888 (May 19, 2002)

ok try now it had .reg at the end of it for some reason i took the reg off well see if it works


----------



## Davey7549 (Feb 28, 2001)

notredame888
Here is a screenshot of the process.
Dave


----------



## notredame888 (May 19, 2002)

davey something is not right. on my desktop the file is named policies.txt when i highlight it to go into the attach box it shows up in the attach box as just policies. if i go ahead and click open here is how it shows up.

C:\WINDOWS\Desktop\policies.txt.reg

form there i click submit post and then it comes up and tells me not a valid attachment or whatever.

is it possible for me to email this to u? or would u rather have me try to figure it out on the boards?


----------



## Davey7549 (Feb 28, 2001)

notredame888
You have a double extension on the policies file. Right click the policies file, select rename and rename it policies.txt without the .reg on the end.
Is = policies.txt.reg 
Should be = policies.txt

Dave


----------



## notredame888 (May 19, 2002)

ok maybe now


----------



## notredame888 (May 19, 2002)

something is wrong davey. on my desktop it is named policies.txt when i click open to attach the file it is automatically putting in the .reg at the end. and if i try to take off the reg it submits the post without the extension. i beleieve i am doing things correctly


----------



## Davey7549 (Feb 28, 2001)

notredame888
Curious
Move the policies.txt file to your documents and rename it there to newpolicies.txt and browse to that location. The desktop is a funny animal that has it quirks maybe that is it.
Dave


----------



## notredame888 (May 19, 2002)

shoot it still adds that stupid reg on there


----------



## Mosaic1 (Aug 17, 2001)

Start over. 

Go into the Registry and export the file again. Save it as a text file to begin with, Save as All files. Try to resolve your bigger problem first.

Look at the attachment. 

BTW Do you have any dll files sitting on the desktop? If you do. put them somewhere else.


----------



## notredame888 (May 19, 2002)

ok here we go


----------



## notredame888 (May 19, 2002)

everyone applaud for notre lol


----------



## Davey7549 (Feb 28, 2001)

notredame888
Thanks to Mosaics knowledge of desktop and browsuei we have our file!
Thanks Katie!
Anyway the bad news is nothing is there thats causing this.
Well now we go and drag out all the guns and try patching all the registry with respect to System Restore, PCHeath and Help and Support.
Follow the instructions below and lets see if this solves it!
------------------------------------------------------------------------------------
--------------------------
SEPT. 8 2001 update patch
--------------------------
Go to this link and try fix. 
http://support.microsoft.com/default.aspx?scid=kb;EN-US;q290700 
-------------------------------------------------------------------

Now download the attached Text file to the desktop as you did before and change the name to Restore.reg
After downloaded and name changed double click to merge as you did before.

Restart system. 
--------------------------------------------------------------------
Now go to and follow these instructions in the MSKB article.
Possibility of missing or corrupt dll 
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q276995

Restart system afterwards and try System Restore.

Dave


----------



## notredame888 (May 19, 2002)

1. downloaded the fix, opened it, installed, restarted pc, system restore still didnt work.

2. i saved teh other file as restore.reg doublicked and files were succesfully add to registry. restarted my pc and it still didnt work

i have printed out the Q article directions and i will need to follow those instructions and do that to see if that fix will work. i wont be back on pc until probably around 6pm est time wednesday i have to drive to detroit early am. so thank you both for all your help to this point hopefully the next step will work ill let u know as soon as i do it thanks again


----------



## notredame888 (May 19, 2002)

hey quick question is the file i need to extract and replace msxml.dll ?


----------



## Davey7549 (Feb 28, 2001)

notredame888
Yes the MSXML.DLL needs to be extracted and placed in the C:\Windows\System folder

Dave


----------



## notredame888 (May 19, 2002)

ok davey i finally got a chance to do this the msxml.dll was succesfully extracted and i placed it in the C:\windows\system 
folder. restarted my pc and same thing. system restore is checked as disabled and if i try to launch it i still get the message system restore is not protecting your pc. restart and try again.


----------



## Davey7549 (Feb 28, 2001)

notredame888
OK......Something is not quite right here. 99% of the problems regarding System Restore are solved with all the prcedures we went through.......so something unusual is going on.
Two items I need you to do:
----------------------------------------------------------------------------------
Do a search for filelist.xml and create a copy of it. Follow the instructions below to create a copy.
1) After locating the Filelist.xml right click and open with notepad
2) Click the edit tab up top of the filelist.xml file and select all
3) After all within the file is selected click the edit button again and select copy
4) The close the filelist.xml file
5) Open a new notepad and paste the contents you copied to the new notepad
6) Save the new notepad as flist.txt to your documents file
7) Attach the flist.txt file to a post here
------------------------------------------------------------------------------------
Next part is creating a startuplog.com from rmbox.
Go to and download startuplog.com from http://home.earthlink.net/~rmbox/Reticulated/Only_IE.html 
After program is downloaded double click the startuplog.com program Icon and it will create a startup log text file.
Create another post here and attach the results from the startuplog program to the post.
------------------------------------------------------------------------------------

Dave


----------



## notredame888 (May 19, 2002)

small problem. when i try to paste the filelist.xml into notepad it tells me not enough memory, exit some programs then try again. so i went in safe mode and tried it and it said same thing. i have 191mb of ram.


----------



## Mosaic1 (Aug 17, 2001)

If the file is larger than 64 KB paste it into Wordpad. Notepad cannot handle any file larger than 64k.

EDIT: But if so, you won't be able to attach. Why don't you break up the file into two parts. Then create two separate text files and post those.


----------



## Davey7549 (Feb 28, 2001)

notre
Another possible way to create the text file is to open in notepad and once opened select the file tab up top and select the save as option and type in flist.txt and save to your documents file.
Try that.
If file is bigger than 64KB the use the copy and paste routine and do it in halves which will require you to make two posts with each half of the list.
Dave


----------



## notredame888 (May 19, 2002)

ok that worked here is filelist1


----------



## notredame888 (May 19, 2002)

and here is filelist2


----------



## Davey7549 (Feb 28, 2001)

Thanks for the heads up Katie.
Notre
Now continue on and get us the startuplog.

Dave


----------



## notredame888 (May 19, 2002)

ok here is second part u asked for about the startup log


----------



## Davey7549 (Feb 28, 2001)

Notre
It is going to take some time to manually compare my filelistxml to your filelist.xml so it may be tomorrow before I complete it.

Dave


----------



## notredame888 (May 19, 2002)

can i delete them icons on my desktop that we created so far?i have restore, startlog, stubpath, policies.txt,


----------



## notredame888 (May 19, 2002)

ok davey that is fine. take your time no hurry here i appreciate all of your help. both u and mosaic. thanks again


----------



## Davey7549 (Feb 28, 2001)

Notre
Yes go ahead, but do not delete the program Icon of Startuplog.com
Dave

Katie
I have to run, could you instruct Notre how to extract a new copy of regedit.exe and try rerunning the startuplog after thet extraction.
Dave


----------



## Mosaic1 (Aug 17, 2001)

Notre,

Before we go any further please post the make and model of your computer. 

To extract a fresh copy of regedit.exe go to C:\windows and rename regedit.exe to regedit.old.

Then you are going to search your cabs for regedit.exe using findfiles.

See attachment for instruction on how to fill in the find files forms.

Mine is set to Search the C Drive because I have a restore disk and therfore have the cabs on the hard drive. 
Do it like that if you have the same.

If however, you use a regular install disk, you will be searching the CD Drive. Change that.

The search result will be the cab which contains regedit.exe
Double click the cab file and then find regedit.exe. Right click on regedit.exe and Extract to C:\windows.


----------



## notredame888 (May 19, 2002)

i have a micronpc millennia rs 2100 700 mhz 191 mb ram


----------



## notredame888 (May 19, 2002)

mosaic what do u mean go to C:\windows?


----------



## Mosaic1 (Aug 17, 2001)

That means go into the Windows Folder on the C Drive. Easier. Go to start>run and type * .. * Press enter. The windows folder will open.

I need to know if you use a restore disk or if you have a regular install CD please.


----------



## notredame888 (May 19, 2002)

i have a windows me startup disk. it is a cd. i think that is what u mean. windows me was preinstalled on my pc


----------



## notredame888 (May 19, 2002)

in the c:\windows i have just plain "regedit" there is no .exe on there is that the one to rename to regedit.old?


----------



## Mosaic1 (Aug 17, 2001)

If you right click on it and choose rename, you'll see that it is regedit.exe. The name is long and is not fully showing. Rename it regedit.old


----------



## notredame888 (May 19, 2002)

ok i am all caught up with what u wanted me to do now. my regedit file was still only named regedit so what i did was renamed that to regedit.old then when i searched like u said to i found regedit and i extracted that to C:\windows so now i have regedit and regedit.old


----------



## Davey7549 (Feb 28, 2001)

Notre
Now that a fresh copy of Regedit is in the C:\Windows file try rerunning the startuplog.com program. There needs to be listings under the headings. This is an example of what you had.

-----------------------------------------------------------------------------------
1. HKLM Run - Registry

[RegPath] 
"StartUp"

*(RegPath not found..)* 
-----------------------------------------------------------------------------------
Notice its says Reg path not found! All your major keys stated the same. There should be items listed underneath those keys.

Dave


----------



## Mosaic1 (Aug 17, 2001)

Dave,
I wondered why you wanted a new copy of regedit. I don't think it is going to help. Regedit is an interface for the user to view and edit the Registry. Startlog will use an Interface provided by the Windows API, I think, to read the registry. If it reports that a path is not there, it is more than likely that it is not there.

I have seen this before at another Forum after a Virus. Large chunks of the registry missing. The Startup.log looked very similar to what you are describing.


----------



## notredame888 (May 19, 2002)

i reran the startup and it said path not found on them again/


----------



## Davey7549 (Feb 28, 2001)

Notre
Looks as if Katie is correct in Her assessment of Regedit not being the problem. Have you had a major virus that you removed? If so what was it?
Dave


----------



## notredame888 (May 19, 2002)

ok here is the deal with the virus thing. i have been getting sent the [email protected] virus like 3 or 4 times a week. but now that my antivirus is set up right it gets quaratined every time. but before my antivirus was set up correctly i got the klez virus and had 15 files infected. so i went to symantec.com and download the klez removal tool. when i ran the tool a message would come up and say the tool has detected that system restore is enabled plz disable it and run the tool then. but when i would go in there to do that my pc says it was already disabled. so that is how i got into knowing about my system restore problem. now i finally ended up saying screw what that tool is telling me and i ran it anyways and at the end it says the tool did not find any variants of klez on your system. i forgot to mention that when the files were infected i quaratined and delted them becuz it could not repair them. that is probably why the tool said it didnt find any. becuz there probably wasnt. and ever since then i have been running virus scans just about every night and it always comes up clean. hopefully i explained that good enough


----------



## Rollin' Rog (Dec 9, 2000)

The two or three times that I have seen that problem with the Startup log, it seemed to be associated with the blebla worm. In a couple of cases at least there was a missing or damaged regedit, just like here. In two instances the problem was repaired either by restoring the regedit file or by running one of the registry patches to fix damage from the worm.

Try the exefix08 file from Reticulated Toys:

http://home.earthlink.net/~rmbox/Reticulated/Toys.html

Unzip and double click it to merge it to the registry.


----------



## notredame888 (May 19, 2002)

during the test i watched it say cannot execute regedit and cannot execute rundell it also said cannot execute 1 more thing i belive it was something with start up. i am attaching the results of the read me which says the correct exe registry data has been restored. what is the next step do i try to do the startuplog again?


----------



## Davey7549 (Feb 28, 2001)

Notre
Before we go any further retry System restore. If still causing problems then back track in this thread and rerun Startuplog.com and post the results here.
Dave


----------



## notredame888 (May 19, 2002)

i dont think it worked but i will attach the log anyway. hey while i was running the startup log i noticed it said for windows 95/98. since i have windows me could that be why it will not work?


----------



## Davey7549 (Feb 28, 2001)

Notre
Startuplog.com is compatable with WinME I use it quite often and so has others.
No it did not work! How frustrating. At the bottom of the startuplog text file it states *Regedit is not a valid Win32 application.* This part I am not sure there is a work around for.
It appears some serious virus damage may of been done and a reinstall over the top of WinME may be the only course of action at this time. Before we do that I would wait to see if Rollin Rog or Katie has any other ideas.

Dave


----------



## notredame888 (May 19, 2002)

ok if we end up doing that wil i lose all my info on my pc? or will it just replace windows me? second it was preinstalled on my pc so i dont have a disk for it unless u mean the restore cd


----------



## Davey7549 (Feb 28, 2001)

Notre
You should not loose any information reinstalling WinME over the top. *Using the Restore CD you WILL loose everything so that is not an option at this time.* As far as how the reinstall will be done is by using the Cab file Setup program. I have directions for this process but as I said before lets wait to see if Rog or Katie has any other ideas.

Dave


----------



## notredame888 (May 19, 2002)

ok that makes me feel better lol.


----------



## Davey7549 (Feb 28, 2001)

Notre
Rog and Katie generally are on line later in the morning so we need to wait. In the mean time do a search for BASE2.CAB and hopefully it is found. Once found right click it and open the containing folder and look for SETUP.EXE. Do not do anything with this yet but we need to know it is there.
Dave


----------



## notredame888 (May 19, 2002)

base2 was found but setup.exe was not in there a whole bunch of other stuff was though


----------



## Davey7549 (Feb 28, 2001)

Notre
Where Base2.cab was located where on your system? Should be in C:\Windows\Options\Cabs 
When you opened the containing folder did you scroll through the whole list to find out if Setup.exe is there?

Dave


----------



## notredame888 (May 19, 2002)

yes it was in C:\windows\options\cabs. i did scroll through the whole thing it was in alphabetical order and setup.exe was not in there


----------



## Davey7549 (Feb 28, 2001)

notre
At this point I am concerned! The Setup.exe and its associated text file should of been listed there unless MicronPC has for some reason optioned not to install that in the Cabs folder. The next question becomes if I send you the Setup.exe and associated test file would it work on your PC? Don't have an answer for that.
This is the system you said you have correct:
micronpc millennia rs 2100 
Dave


----------



## notredame888 (May 19, 2002)

yes that is correct


----------



## Davey7549 (Feb 28, 2001)

Notre
At this point we wait for Rog and Katie to see if they have other suggestions.
I will be offline a little later since I have to go into work today but will hang around for a bit yet.
Dave


----------



## Rollin' Rog (Dec 9, 2000)

All the previous times I have seen that sort of problem with the starup log were related to infections of one kind or another -- usually blebla, but I think some trojans were involved as well.

edit: well I do see where you have run NAV, but was anything identified besides klez? We had a previous poster with NAV which failed to detect a trojan. He had the same issues with the startup log you have.

If you go to start>run and enter regedit, does it open?

As an alternative to the Startup Log, it might be helpful to see a post of Running Tasks from Msinfo32 (We did Startup Programs before, but that is not as thorough).

Start>Run> msinfo32
Click Software Environment, then Running Tasks.
Click Edit>Select All>Edit>Copy and paste the copied text.


----------



## Mosaic1 (Aug 17, 2001)

First. I was wrong about Startup Log and regedit. I'll remember that trick in the future.

I am not sure about any other computer and using the cabs to overinstall but my own HP. I do know that I have tried twice in the past to install Windows over the top using setup.exe in the cabs. I always have an error and then have to use the Restore Disk. Once it gets far enough to error, my windows configuration is invalid. I run Win98 SE on an HP Pavilion 8760c.

Here's the error and its KB article:
Error SU0350 
Setup was unable to display the Nondisclosure Agreement. Setup will now close

I have checked the license.txt per the article and it is the same in both locations. Have a look at the article and print it out in the event that you get this same error overinstalling. Maybe the remedy will work for you.

I'd like to see Dave's directions. Maybe they include something more than what I do. If you do start an overinstall and it fails, you can use the Recovery Disk.

Recovery disks are different as well. Mine has the choice if Format or not. If I do not Format, I don't lose files. However, even though all the shortcuts to the programs I have added are still on the menu, those programs are no longer installed. You will need to reinstall everything. My Computer is back as it was when I bought it. But my personal files are there. 
I have a new registry and new files.

If I format, then everything is gone.

That's how HP works.

I cannot speak for your recovery disk. They differ. If you want to find out, you might start the process and see what is on the menu. Then do not choose anything and cancel out.

Wait for Dave to come back. Let's see how he does it from the cabs.

EDIT: Again, I use a different OS. But my setup.exe is not in a cab in the cabs. It is just sitting there loose in C:\windows\options\cabs.


----------



## Mosaic1 (Aug 17, 2001)

I believe the reason why you see regedit and not regedit.exe is this. Go into Folder Options>View and scroll to this entry:
Hide file extensions for known file types.

If you have it checked, uncheck it. You need to see file extensions. Viruses often have double extensions. If you cannot see them, you won't be alerted to this and might open something you shouldn't.


----------



## notredame888 (May 19, 2002)

ok in response to rog's post. yes regedit does open when i go to start and run. and klez was the only virus that has ever been detected on my system. i have also been running housecall's online virus scan quite frequently which for some reason scans like 30,000 more files then nav and that has come up clean all but like 1 or 2 times of finding the klez. i contacted nav about why nav doesent scan that many files and they said it is possible that housecalls scans in the restore folder which doesnt need to be scanned or something like that. ok now i will paste the info you requested below...


aim.exe	c:\program files\aim95\aim.exe	0xfffa7727	32	Not Available	Not Available	Not Available	4.7.2480	52.00 KB (53,248 bytes)	4/21/2002 8:19:14 PM
csinject.exe	c:\program files\norton systemworks\norton cleansweep\csinject.exe	0xfffe8623	32	Not Available	Not Available	Not Available	6.01.0012	28.00 KB (28,672 bytes)	5/8/2002 9:22:35 PM
ddhelp.exe	c:\windows\system\ddhelp.exe	0xfff6872b	256	Not Available	Not Available	Not Available	4.08.01.0881	31.00 KB (31,744 bytes)	12/7/2001 7:15:20 PM
dpps2.exe	c:\program files\panicware\pop-up stopper\dpps2.exe	0xfffc4e23	32	Not Available	Not Available	Not Available	1, 0, 0, 1	680.00 KB (696,320 bytes)	4/29/2002 12:38:31 PM
explorer.exe	c:\windows\explorer.exe	0xfffd6db3	32	Not Available	Not Available	Not Available	5.50.4134.100	220.00 KB (225,280 bytes)	6/8/2000 5:00:00 PM
helpctr.exe	c:\windows\pchealth\helpctr\binaries\helpctr.exe	0xfff60c9b	32	Not Available	Not Available	Not Available	4.90.0.3002	484.27 KB (495,888 bytes)	4/19/2001 9:51:12 PM
iexplore.exe	c:\program files\internet explorer\iexplore.exe	0xfff6691f	32	Not Available	Not Available	Not Available	6.00.2600.0000	89.00 KB (91,136 bytes)	8/17/2001 10:34:06 PM
kazaa.exe	c:\program files\kazaa lite\kazaa.exe	0xfffc59ef	32	Not Available	Not Available	Not Available	1, 7, 0, 0	1.85 MB (1,937,920 bytes)	6/1/2002 11:01:20 AM
kernel32.dll	c:\windows\system\kernel32.dll	0xffefb1ef	128	Not Available	Not Available	Not Available	4.90.3000	524.00 KB (536,576 bytes)	Not Available
kernel32.dll	c:\windows\system\kernel32.dll	0xfffffa1b	32	Not Available	Not Available	Not Available	4.90.3000	524.00 KB (536,576 bytes)	Not Available
kernel32.dll	c:\windows\system\kernel32.dll	0xfffe1a0f	32	Not Available	Not Available	Not Available	4.90.3000	524.00 KB (536,576 bytes)	Not Available
minilog.exe	c:\windows\system\zonelabs\minilog.exe	0xfffebcc7	32	Not Available	Not Available	Not Available	2.6.362	27.95 KB (28,624 bytes)	5/3/2002 11:23:00 AM
mprexe.exe	c:\windows\system\mprexe.exe	0xfffe1fcb	32	Not Available	Not Available	Not Available	4.90.3000	28.00 KB (28,672 bytes)	Not Available
msimn.exe	c:\program files\outlook express\msimn.exe	0xfff71a3b	32	Not Available	Not Available	Not Available	6.00.2600.0000	56.00 KB (57,344 bytes)	8/17/2001 10:32:16 PM
mstask.exe	c:\windows\system\mstask.exe	0xfffe655f	32	Not Available	Not Available	Not Available	4.71.2721.1	124.00 KB (126,976 bytes)	Not Available
navapw32.exe	c:\program files\norton systemworks\norton antivirus\navapw32.exe	0xfffb1933	32	Not Available	Not Available	Not Available	8.07.17	73.62 KB (75,384 bytes)	3/5/2002 4:04:48 PM
pstores.exe	c:\windows\system\pstores.exe	0xfff6ff07	32	Not Available	Not Available	Not Available	5.00.2133.2	82.77 KB (84,752 bytes)	Not Available
speedkey.exe	c:\program files\microsoft hardware\keyboard\speedkey.exe	0xfffb2e7f	32	Not Available	Not Available	Not Available	1.20.532	30.50 KB (31,232 bytes)	3/16/2001 5:27:58 PM
stimon.exe	c:\windows\system\stimon.exe	0xfff85abb	32	Not Available	Not Available	Not Available	4.90.3000.1	27.77 KB (28,432 bytes)	Not Available
systray.exe	c:\windows\system\systray.exe	0xfffc898f	32	Not Available	Not Available	Not Available	4.90.3000	36.00 KB (36,864 bytes)	Not Available
vsmon.exe	c:\windows\system\zonelabs\vsmon.exe	0xfffe50f7	32	Not Available	Not Available	Not Available	2.6.362	471.30 KB (482,608 bytes)	5/3/2002 11:22:58 AM
weather.exe	c:\program files\aws\weatherbug\weather.exe	0xfffa24d3	32	Not Available	Not Available	Not Available	3, 0, 0, 17	760.00 KB (778,240 bytes)	12/31/2001 10:47:26 PM
winmgmt.exe	c:\windows\system\wbem\winmgmt.exe	0xfff14c1b	32	Not Available	Not Available	Not Available	1.50.1164.0000	192.08 KB (196,685 bytes)	Not Available
wmiexe.exe	c:\windows\system\wmiexe.exe	0xfffdf857	32	Not Available	Not Available	Not Available	4.90.2452.1	16.00 KB (16,384 bytes)	Not Available
zonealarm.exe	c:\program files\zone labs\zonealarm\zonealarm.exe	0xfff93c87	32	Not Available	Not Available	Not Available	2.6.362	856.55 KB (877,104 bytes)	5/3/2002 11:22:59 AM


----------



## notredame888 (May 19, 2002)

ok now in response to mosaic. yes you were correct i did have it checked i unchecked it and now it says regedit.exe 

i also am running a program called script defender which will alert me before opening certain attachments. and in outlook express i have that set up to not even let me open attachments


----------



## Rollin' Rog (Dec 9, 2000)

Ok, well that gives a better look than what we've seen before, but unfortunately no obvious explanation that I can see for the problems you are having 

It looks like you are going to reinstall Windows, so I guess we'll just see how that goes.


----------



## Davey7549 (Feb 28, 2001)

Notre
Seems like you really have something going on here that is serious. We need to get a reinstall done. There is going to be some prep work that is necessary before we do this.
1) Run a through Scandisk in Safemode
2) Private Message your E-Mail address so I can send you the Setup.exe program

After I have sent you the setup.exe program I will draft the instructions for clean booting system to prepare for reinstall.
Then I will post the instrcutions I have for install Cab files.

Dave


----------



## notredame888 (May 19, 2002)

ok thorough scandisk will take a couple hours but i will start it right now its 134 est ill post a message when its done


----------



## notredame888 (May 19, 2002)

ok scandisk was going for 1 hour 30 minutes and a message came up and said scandisk has restarted 10 times because something was writing to the disk and i was in safe mode. grrrrrrrr
i also have norton system works that will scan my pc and fix any errors also do u want me to run that one? as far as the email u sent me davey i check and i have all 8 of them in the windows\options\cabs. how do i go about downloading them do i have to do each one indiviudaully?


----------



## Davey7549 (Feb 28, 2001)

Notre
I am a little confused did you not say before you did not have Setup.exe in the cabs folder?
If you already have all the files I sent via E-mail then ingore the attachment. If you are missing any of the ones I sent then save those in the attachments to your C:\windows\options\cabs file.
Now for scandisk. I was not aware you have been using norton disk doctor. By all means use Norton Disk Doctor instead of Windows Scandisk. We are only checking for faulty areas on the hard drive.

Now a few other questions. Do you have the Product ID number of your WinME software? Is it written on the recovery CD?
If not we will have to get into the registry to find it and jot it down for use later. (We may just check the number anyway.)
Also if all our attempts end up failing using the setup through the cab files, do you have a friend who has a full version legal copy of WinME? If they do then you would be able to use thier Legal copy with your Product ID which you own and setup from the CD.
I believe this would not constituit piracy since you own a legal copy and product ID.

Dave

PS: I am going to be away till around 8:00 CST and will pick up from there.


----------



## notredame888 (May 19, 2002)

yes davey that is strange i know i looked for the setup.exe before and said i did not have it. perhaps i was in the wrong spot or something but i do have every one of those attachemnts in the cabs folder. yes i do have the product key written on of recovery disk also. i dont have access to a windows me disk though. i hope by not finding setup.exe earlier i didnt lead u in wrong direction if i have i appologize. so i will let norton scan my system and then check back with ya this only takes a few maybe 15 minutes or so to do.


----------



## notredame888 (May 19, 2002)

ok no errors were found after running disk doctor


----------



## Davey7549 (Feb 28, 2001)

Notre
Had a minute between jobs so I thought I would check in. 
OK now lets go into the registry and find you *ProductID* and *ProductKey* in case you are asked for it.
1) Go to start\run and type in regedit and hit enter.
Hopefully the program will work.
2) In the left pane you will see major keys with plus signs in front of them. The plus signs are used to navigate down a registry leg.
Navigate down this leg by clicking the plus signs in front of these listed below.
Navigate to:
+ HKEY_LOCAL_MACHINE
+ Software
+ Microsoft
+ Windows
CurrentVersion <------ Click to open this folder not the plus sign

3) Scroll down the right pane and locate *ProductKey* and then *ProductID* then Jot down both the numbers. Double check numbers because they are critical.
4) After you have recorded those numbers on a piece of paper then click the registry tab up top of the regedit menu and click exit.

Have to run again will check back later.

Dave


----------



## notredame888 (May 19, 2002)

ok np i got both numbers written down and double checked whenever your ready. it is a good thing i checked tehre for my product key becuz it was different then the product key on my restore disk lol omg now that i look closer at it it look like the store might have given me the wrong one. it say microsoft windows 98 and "for distribution with a new emachines only"
those *******s i hope we dont need that i have had my pc for almost 2 yrs now.


----------



## Davey7549 (Feb 28, 2001)

Notre
Well I guess we are ready to attempt the reinstall. These are the instructions to do it in Safe Mode. There are instructions for DOS mode but lets try this first.
-----------------------------------------------------------------------------------
Print these instructions so you have them available. Read through all of them so you understand the process and what is needed for completion.

If you have IE6 installed, you must first remove it.
See "How to Remove Internet Explorer 6.0 or Outlook Express 6.0 Before You
Reinstall Windows (Q312474)"
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q312474
-----------------------------------------------------------------------------------

Step 1- After Internet explorer 6.0 is removed if you have it then
Go to Start\Run and type in msconfig
Step 2- Cilck the selective startup radio button and remove the Load startup group check mark and click Apply then Ok
Step 3- Restart computer and boot into Safe Mode
Step 4- Disable all antivirus programs if running 
Step 5- Go to the Folder where you found BASE2.CAB (C:\Windows\Options\Cabs) and double-click on SETUP.EXE
Step 6- Follow all prompts from there and if errors 
occur record what errors they are.

After the reinstall, go to the "Windows Update Setup Files" folder (You should have one and it should be located under C:\ ) and run its IE setup program.
And then go online to "Windows Update" site, and get all the other updates you need.

Good luck Notre we are all pulling for you.

Dave


----------



## notredame888 (May 19, 2002)

davey, i received a error mesage right away that says "not enough conventional memory to check your computers hard disks. you need to free some conventional memory before continuing. it has this website in the setup.txt regarding Q aricle #134399 http://support.microsoft.com/support/kb/articles/q134/3/99.asp

when i read it i see alot about doing it in dos and having to remove drivers and stuff. could u explain how to free up the memory to continue thanks alot


----------



## Davey7549 (Feb 28, 2001)

Notre
Rather than messing around with conventional memory lets run Setup in DOS. First item you need to do is create a Startup Disk if you do not have one.
Have a Clean Formatted Floppy handy and Go to Start\Setting\Control Panel\Add-Remove Programs and Click on the Startup Disk tab. Insert Floppy and Create Disk.
After Disk is created this will be inserted in Floppy drive "A" and you must restart. During restart you will see a popup that has several options. Arrow down to Minimal Support and hit enter.
When you receive the A:>Prompt Type C:
Then follow the instructions below.
Type in at C:>Prompt
*CD C:\WINDOWS\OPTIONS\CABS* Then hit enter
Then type in *SETUP* Then hit enter

Print this so you have it and follow prompts.
Good Luck.
Also Install IE from SafeMode which was listed in previous instructions.

NOTE: If it still comes back with Conventional memory error then we will deal with it.
Dave


----------



## notredame888 (May 19, 2002)

ok my next ? is i have a startup disk on a cd is that ok? my pc will boot form cd i just have to have it in my dvd drive when i restart. the only difference is i dont have a minimal support option. my options are i belive continue with cd support, continue without cd support, and i cant remeber the 3rd one then there is a timer tciking down. which one should i chose?


----------



## Davey7549 (Feb 28, 2001)

Notre
I would prefer you to keep this process as simple as possible. Can you create a startup disk? If so please do and use that.
Dave


----------



## notredame888 (May 19, 2002)

np i just have to run to computer store lol my disks it said werent big enough it is no big deal i can run real quick. gimme about 30 minutes and ill get back with ya thanks


----------



## notredame888 (May 19, 2002)

WELL I HAVE SOME VERY GOOD NEWS........system restore is now working. everything went great with the new install a few minor bugs ill talk about in a few but i got ie6 installed and updated all my settings with windows update and lastly i check the system restore and it is turned on now. thank you so much to davey, mosaic, and rollin rog u guys have been the biggest help through all of this. i could have paid for tech support and i know they would have got to the bottom of it like u guys did. secondly let me address a couple issues i might be concerned about...

1. i probably need to create a manual resotre point so i dont have to redo this correct? if so how do i do that?

2. during the install i received 1 error message that said "the file netracacm.sys was not found" not sure what that is maybe u guys know.


3. after the install the bugs i was talking about were everything was going very slow and alot of programs were not responding for me and it took me 6 times to install ie6. what i did was installed 5.5 and when that went through i did ie6 and it worked good. as far as the other bugs i ran norton systemworks and it found 20 errors mostly in the registry and it fixed them then things seemed to work out alot better.


4. the last thing i can think of is i like to keep as little as posibble running in the startup. and there are a few things i dont know if i can turn htem off or not they are...
a. taskmonitor
b. load power profile (there is 2 of them both checked)
c. loadQM
d. run= (there is 2 of them also both checked)


----------



## Davey7549 (Feb 28, 2001)

Notre
Well that makes me extremely happy as I am sure it will Katie and Rog! 
Congradulations my friend......You did it!

-----------------------------------------------------------------------------------
Lets address the issues you have listed.
1) IE 5.5 verses IE 6.0. Windows ME setup even though there are is no click on me to set up IE 5.5 some of the Internet Explorer is defined during the Reinstall. To make a long story short you did well to figure out setting up IE 5.5 was the ticket and then moving to IE 6.0.

2) System Restore is another story. You have System Restore operational but may still need to retrieve the Sept 8 2001 bug update for it to function properly. I suspect it will not Restore back to a date even though it was created recently until the patch is in place. To test for the bug follow these steps:
A: Go to Start\Programs\Accessories\System Tolls\System Restore
B: Once there click to create a restore point 
C: Name it Test Restore Function
D: After Restore Point is created then close and restart system.
E: Go back to System Restore screen and this time select the Restore to previous and select your Restore date Test Restore Function and follow prompts
F: If restore is working properly it will finish restore, Restart system, and come back to the System Restore screen and tell you it has successfully restored to previous.
Note: If you have updated your virus definitions recently wait a day to try the system restore function so Windows has safely saved the definitions by date. If you don't you may end up with the NAV engine not starting at Boot.

Also when you try the restore point and if it says it cannot restore then go to this site and download the patch.
http://support.microsoft.com/default.aspx?scid=kb;EN-US;q290700

3) netracacm.sys I have not a clue what that is and will have to investigate.

4) taskmonitor- can be unchecked since you do not need to worry about putting certian programs first with the speed of todays drives.
load power profile- (there is 2 of them both checked) Can be unchecked if you are not planning on using Standby, Hibernate and so on.
loadQM- Pain in the but for resources. Uncheck also. 
run= (there is 2 of them also both checked) If there is nothing after the equal signs then uncheck. If there is somthing after them then what is it?

Dave


----------



## notredame888 (May 19, 2002)

dave,

rock on the system restore worked just like u said it should so i do not need the patch.

in the startup after run= they both say the same thing under the loaded from column it says win.ini and under command it says hpfsched so they both look like this




run= win.ini hpfsched


----------



## Davey7549 (Feb 28, 2001)

Notre
No problem with the Run lines they both belong to you HP printer!
I have the Same.

That netracacm.sys I cannot find anything on it and that concerns Me. Go to Haousecall and run an Online Virus Scan and make sure we are not dealing with leftovers here.
http://housecall.antivirus.com/housecall/start_corp.asp

Also Download and Run Moosofts Trojan cleaner. It has a 30 day free trial but I sure do not want to go through this again if there is a sleeper in there. Rog mentioned Bleba worm.
http://www.moosoft.com/intro.php

Lastly Make sure your onboard Virus scanner is up to date.

Dave


----------



## notredame888 (May 19, 2002)

davey i ran a full system scan with norton 2002 with my defenitions up to date and came back clean. i will also go to house call and run that one before i go to bed i takes like an hour on my pc for housecall. i went to moosoft and when i click on the download the cleaner it takes me to a page and all it says is 404
now i do have a tool called panda quick remover on my desktop and when i double click it it scans my pc and usually tells me it dosent find anything. but it is acting weird on me now saying something like 76 viruses and mutations and then it scans and says im all clean but if i run it again it tells me the same thing lol.
so what do u think should i trust norton and double check with housecall? or should i start freakin out and trust the panda


----------



## Davey7549 (Feb 28, 2001)

Notre
If Your Norton came back with no viruses and Housecalls come back with the same I would feel comfortable. Dump the Panda though since it is probably all messed up since the reinstall. Beside it is not good to have two Virus Engines running at the same time since they do not play well together. Lastly maybe Moosoft has changed its address or is down. At this point it may be best to trust what you have.
Sleep well you worked hard on this one!
Dave


----------



## notredame888 (May 19, 2002)

thanks again


----------



## Davey7549 (Feb 28, 2001)

Good night my friend, let us know how the housecalls scan turned out!

Dave


----------



## Mosaic1 (Aug 17, 2001)

Dave's probably right. 

I don't trust though and have seen three AV's scan clean when there is something there. So to be safe, I am glad you are doing an online scan.

If you want advice on your startups, how about running Startup Log and posting it? I for one, would love to see your brand new restored registry keys! LOL


You two did a great job. I'm glad to see it worked so well.


----------



## notredame888 (May 19, 2002)

well the housecalls says i am clean. but i think something is wrong with it or something it used to scan like 70,000 files on my pc. norton scans 48,000 and all of a sudden the last 3 or 4 times i use housecall it scans like 4,600 files and then ends and says i am all clean. and i have all of the boxes checked on the left too. so let me know if that sounds right to u for it to only scan 4,600 files.


----------



## notredame888 (May 19, 2002)

here ya go mosaic1,

---------- C:\WINDOWS\desktop\StartUp.Log

Start-Ups checked at 06-02-2002 9:14:44.35p 
__________________________________________________________________________ 
__________________________________________________________________________

StartUp Log for Windows 95/98 - Freeware by rmbox 
__________________________________________________________________________ 
__________________________________________________________________________

Comments:

This is a log of all the programs on your computer that 
are starting automatically every time you start Windows. 
Using this log can be a quick way to spot trojans.

StartUp Log (version 1.56) - Release Date 3/11/2002

__________________________________________________________________________ 
__________________________________________________________________________

StartUp Log Index

1. HKLM Run 
2. HKCU Run 
3. HKLM RunOnce 
4. HKCU RunOnce 
5. HKLM RunServices 
6. HKLM RunServicesOnce 
7. WIN.INI file 
8. SYSTEM.INI file 
9. AUTOEXEC.BAT file 
10. StartUp folder 
11. All Users StartUp 
12. Misc. StartUp Configurations

__________________________________________________________________________ 
__________________________________________________________________________

The following is a list of your current Start-Ups 
__________________________________________________________________________ 
__________________________________________________________________________

1. HKLM Run - Registry

[RegPath] 
"StartUp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ScanRegistry"="C:\\WINDOWS\\scanregw.exe /autorun"
"PCHealth"="C:\\WINDOWS\\PCHealth\\Support\\PCHSchd.exe -s"
"SystemTray"="SysTray.Exe"
"Microsoft IntelliType Pro"="\"C:\\Program Files\\Microsoft Hardware\\Keyboard\\speedkey.exe\""
"Pop-Up Stopper"="\"C:\\PROGRAM FILES\\PANICWARE\\POP-UP STOPPER\\DPPS2.EXE\""
"NAV Agent"="C:\\PROGRA~1\\NORTON~1\\NORTON~2\\NAVAPW32.EXE"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

========================================================================== 
__________________________________________________________________________

2. HKCU Run - Registry

[RegPath] 
"StartUp"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"AIM"="C:\\PROGRAM FILES\\AIM95\\aim.exe -cnetwait.odl"
"Weather"="C:\\PROGRAM FILES\\AWS\\WEATHERBUG\\WEATHER.EXE 1"

========================================================================== 
__________________________________________________________________________

3. HKLM RunOnce - Registry

[RegPath] 
"StartUp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

========================================================================== 
__________________________________________________________________________

4. HKCU RunOnce - Registry

[RegPath] 
"StartUp"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]

========================================================================== 
__________________________________________________________________________

5. HKLM RunServices - Registry

[RegPath] 
"StartUp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"*StateMgr"="C:\\WINDOWS\\System\\Restore\\StateMgr.exe"
"TrueVector"="C:\\WINDOWS\\SYSTEM\\ZONELABS\\VSMON.EXE -service"
"MiniLog"="C:\\WINDOWS\\SYSTEM\\ZONELABS\\MINILOG.EXE -service"
"ScriptBlocking"="\"C:\\Program Files\\Common Files\\Symantec Shared\\Script Blocking\\SBServ.exe\" -reg"
"CSINJECT.EXE"="C:\\Program Files\\Norton SystemWorks\\Norton CleanSweep\\CSINJECT.EXE"
"SchedulingAgent"="mstask.exe"

========================================================================== 
__________________________________________________________________________

6. HKLM RunServicesOnce - Registry

[RegPath] 
"StartUp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

========================================================================== 
__________________________________________________________________________

7. WIN.INI File - (c:\windows\win.ini)

Your win.ini run/load lines should look like run= and load= exclusively. 
There should be nothing to the right of the equal signs.

These are the run and load lines in your WIN.INI file

;Rem TShoot: run=
run=hpfsched hpfsched

load=

========================================================================== 
__________________________________________________________________________

8. SYSTEM.INI File - (c:\windows\system.ini)

Your system.ini shell line should look like shell=Explorer.exe exclusively. 
You should only see Explorer.exe following the equal sign.

This is the shell line in your SYSTEM.INI file

shell=Explorer.exe

========================================================================== 
__________________________________________________________________________

9. AUTOEXEC.BAT File - (c:\autoexec.bat)

(Some trojans have been known to start from this file)

These are your program startups and set paths in your autoexec.bat file

========================================================================== 
__________________________________________________________________________

10. StartUp Folder - (c:\windows\start menu\programs\startup)

Shortcuts to any program will automatically start when placed here.

These are the shortcuts located in your StartUp folder

*(No start-ups found)*

========================================================================== 
__________________________________________________________________________

11. All Users Folder - (c:\windows\all users\start menu\programs\startup)

Shortcuts to any program will automatically start when placed here.

These are the shortcuts located in your All Users StartUp folder

C:\WINDOWS\All Users\Start Menu\Programs\StartUp\ZoneAlarm.lnk

========================================================================== 
__________________________________________________________________________

12. Miscellaneous StartUp Configurations

-============================- 
Registry StartUp Directories 
-============================-

Should show the Start Menu StartUp and All Users StartUp directories

.....................................................................

[1] HKCU - Shell Folders

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

"Startup"="C:\\WINDOWS\\Start Menu\\Programs\\StartUp"

.....................................................................

[2] HKCU - User Shell Folders

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

.....................................................................

[3] HKLM - Shell Folders

HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders

"Common Startup"="C:\\WINDOWS\\All Users\\Start Menu\\Programs\\StartUp"

.....................................................................

[4] HKLM - User Shell Folders

HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\User Shell Folders

.....................................................................

-=======================- 
Registry Shell Spawning 
-=======================-

Open Commands for Executable File Types

@="\"%1\" %*"
(.exe file - RegPath = HKCR\exefile\shell\open\command)

@="\"%1\" %*"
(.com file - RegPath = HKCR\comfile\shell\open\command)

@="\"%1\" /S"
(.scr file - RegPath = HKCR\scrfile\shell\open\command)

@="\"%1\" %*"
(.bat file - RegPath = HKCR\batfile\shell\open\command)

@="\"%1\" %*"
(.pif file - RegPath = HKCR\piffile\shell\open\command)

@="C:\\WINDOWS\\SYSTEM\\MSHTA.EXE \"%1\" %*"
(.hta file - RegPath = HKCR\htafile\shell\open\command)

-=========================- 
HKLM RunOnceEx - Registry 
-=========================-

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx]

-=========================- 
HKU (.Default) Run - Registry 
-=========================-

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Run]
"AIM"="C:\\PROGRAM FILES\\AIM95\\aim.exe -cnetwait.odl"
"Weather"="C:\\PROGRAM FILES\\AWS\\WEATHERBUG\\WEATHER.EXE 1"

-==============================- 
HKU (.Default) RunOnce - Registry 
-==============================-

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\RunOnce]

-================================- 
StubPaths - Registry (Partial Listing) 
-================================-

(Please see the StubPath.txt on your desktop for complete listing)

HKLM\Software\Microsoft\Active Setup\Installed Components

"StubPath"="C:\\WINDOWS\\msnmgsr1.exe"
"StubPath"="C:\\WINDOWS\\COMMAND\\sulfnbk.exe /L"
"StubPath"=""
"RealStubPath"="\"C:\\PROGRA~1\\OUTLOO~1\\setup50.exe\" /APP:OE /CALLER:IE50 /user /install"
"OldStubPath"="\"C:\\PROGRA~1\\OUTLOO~1\\setup50.exe\" /APP:OE /CALLER:WIN9X /user /install"
"OldRealStubPath"="\"C:\\PROGRA~1\\OUTLOO~1\\setup50.exe\" /APP:OE /CALLER:IE50 /user /install"
"RealStubPath"="\"C:\\PROGRA~1\\OUTLOO~1\\setup50.exe\" /APP:WAB /CALLER:IE50 /user /install"
"OldStubPath"="\"C:\\PROGRA~1\\OUTLOO~1\\setup50.exe\" /APP:WAB /CALLER:WIN9X /user /install"
"OldRealStubPath"="\"C:\\PROGRA~1\\OUTLOO~1\\setup50.exe\" /APP:WAB /CALLER:IE50 /user /install"
"StubPath"="C:\\WINDOWS\\SYSTEM\\updcrl.exe -e -u C:\\WINDOWS\\SYSTEM\\verisignpub1.crl"
"StubPath"="C:\\WINDOWS\\SYSTEM\\ie4uinit.exe"

-=================- 
WINSTART.BAT File - (c:\windows\winstart.bat) 
-=================-

@C:\WINDOWS\tmpcpyis.bat

-=================- 
DOSSTART.BAT File - (c:\windows\dosstart.bat)
-=================-

@echo off

REM Notes:
REM DOSSTART.BAT is run whenenver you choose "Restart the computer 
REM in MS-DOS mode" from the Shutdown menu in Windows. It allows 
REM you to load programs that you might not want loaded in Windows, 
REM (because they have functional equivalents) but that you do 
REM want loaded under MS-DOS. The two primary candidates for 
REM this are MSCDEX and a real mode driver for the mouse you ship
REM with your system. Commands that you want present in both Windows
REM and MS-DOS should be placed in the Autoexec.bat in the 
REM \Image directory of your reference server. Please note that for
REM MSCDEX you will need to load the corresponding real-mode CD 
REM driver in Config.sys. This driver won't be used by Windows 98
REM but will be available prior to and after Windows 98 exits.
REM
REM This file is also helpful if you want to F8 boot into MS-DOS 7.0
REM before Windows loads and access the CD-ROM. All you have to do
REM is press F8 and then run DOSSTART to load MSCDEX and your real
REM mode mouse driver (no need to remember the command line parameters
REM for these two files.
REM
REM - You MUST explicitly specify the CD ROM Drive Letter for MSCDEX.
REM - The string following the /D: statement must explicitly match 
REM the string in CONFIG.SYS following your CD-ROM device driver.

REM MSCDEX.EXE /D:OEMCD001 /l:d
REM MOUSE.EXE

-=================- 
WININIT.BAK File - (c:\windows\wininit.bak) 
(name) (type) (size)(modified)(time) 
wininit bak 547 06-02-02 8:10p
-=================-

[Rename]
NUL=C:\WINDOWS\INTERN~1\IAMDB.RDB
C:\WINDOWS\INTERN~1\IAMDB.RDB=C:\_RESTORE\EXTRACT\A0001009.CPY
C:\WINDOWS\powerpnt.ini=C:\_RESTORE\EXTRACT\powerpnt.ini
C:\WINDOWS\wavemix.ini=C:\_RESTORE\EXTRACT\wavemix.ini
C:\WINDOWS\tasks\desktop.ini=C:\_RESTORE\EXTRACT\desktop.ini
C:\WINDOWS\win.ini=C:\_RESTORE\EXTRACT\win.ini
C:\WINDOWS\system.ini=C:\_RESTORE\EXTRACT\system.ini
C:\WINDOWS\USER.DAT=C:\_RESTORE\EXTRACT\USER.DAT
C:\WINDOWS\SYSTEM.DAT=C:\_RESTORE\EXTRACT\SYSTEM.DAT
C:\WINDOWS\CLASSES.DAT=C:\_RESTORE\EXTRACT\CLASSES.DAT

-=================- 
WININIT.INI File - (c:\windows\wininit.ini) 
(name) (type) (size)(modified)(time) 
wininit ini 52 06-02-02 8:42p
-=================-

[Rename]
NUL=C:\WINDOWS\TEMP\WZSE1.TMP\PORT16.DLL
-=====================- 
Screen Saver Settings (Possible system.ini start-up) 
-=====================-

========================================================================== 
__________________________________________________________________________

- Supplemental Environment Information -

COMSPEC=C:\WINDOWS\COMMAND.COM
PATH=C:\WINDOWS;C:\WINDOWS\COMMAND
TEMP=C:\WINDOWS\TEMP
TMP=C:\WINDOWS\TEMP
winbootdir=C:\WINDOWS
windir=C:\WINDOWS

File - c:\windows\Wininit.ini 
File - c:\windows\Wininit.bak 
File - c:\windows\deletefi.ini

========================================================================== 
__________________________________________________________________________

- End -


----------



## Mosaic1 (Aug 17, 2001)

Notre,
Dave thinks and I agree that you should remove the Housecalls object and have another shot at it.

To remove the object, go to C:\windows\Downloaded Program Files
Open the folder and remove the File named
HouseCall Control.

After, go back and have them redo the scan. A new Control will be installed. 

In the meantime, I'll look at your startup log .


----------



## Mosaic1 (Aug 17, 2001)

AIM"="C:\\PROGRAM FILES\\AIM95\\aim.exe -cnetwait.odl I would uncheck it. AIM can be started when you want to use it. -cnetwait.odl is an advertising/spyware file too.

Weather"="C:\\PROGRAM FILES\\AWS\\WEATHERBUG\\WEATHER.EXE 1" Do you really want to start this? If so, it's up to you.
-------------------------------------------------------------
WINSTART.BAT File - (c:\windows\winstart.bat) 
-=================-

@C:\WINDOWS\tmpcpyis.bat This combination may be harmless or it may be used to load a Trojan. Lets see what Housecalls says before we touch it. Do not restart the computer with this as is.

You can rename winstart.bat winstart.old and tmpcpiys.bat to tmpcpiys.old if you have to reboot.

Also, you can right click on each file and choose edit. what are the contents of these files?

EDIT: I forgot about this one.

CSINJECT.EXE"="C:\\Program Files\\Norton SystemWorks\\Norton CleanSweep\\CSINJECT.EXE" 
http://service2.symantec.com/SUPPORT/cleansweep.nsf/docid/1999022413295728

This file can be problematic. And you can start this right before you perform an install. I would not let it run all the time.


----------



## notredame888 (May 19, 2002)

hmmm i wonder what is goin on there. 2 times i removed that files and tried the scan again and it still quits after only 4,000 files. could that file posibbly hide anywhere else?


----------



## Mosaic1 (Aug 17, 2001)

Is this the link you used?

http://housecall.antivirus.com/pc_housecall/

I am going to go over there and run a scan on my computer. It can't hurt. It will also tell me if there is a problem on their side which is possible.

Did you read my last post about your startups?

How's the computer behaving other than that?


----------



## Mosaic1 (Aug 17, 2001)

I tried twice. Active Update did not Update successfully message either time.


----------



## notredame888 (May 19, 2002)

ok so then it is housecall thats messed up right?


----------



## notredame888 (May 19, 2002)

in response to your earlier post i did read your post and hopefully i can get that scan to work to be extra sure i dont have a trojan. my pc is working ok it freezes from time to time and some programs will freez to not responding when they never used to and i might end up reinstalling some of them but i think some errors are to be expected after all it is a computer right? lol. oh and my porn kazaalite was messed up but i got it all fixed lol j/k.


----------



## Mosaic1 (Aug 17, 2001)

I am not sure. It could be due to heavy network traffic. This time of day, things are busy.

I am trying it again. We'll see if it loads.


----------



## Mosaic1 (Aug 17, 2001)

The third time and still ActiveUpdate won't update.

Freezes are not good. Uninstalling and then reinstalling the programs is something to try. I would go slowly. One at a time.

Are you getting any error messages?

Here's a link to a free trial of Tauscan, another Trojan Scanner.

http://www.agnitum.com/download

Download it and install. Update immediately and then run it. They also have a really nice tutorial you can download. It will answer any and all questions you have about Tauscan.


----------



## notredame888 (May 19, 2002)

two errors i have been getting alot is "msimn has caused and error in unknow"

and "rundell.32 has caused and error in kernel" the wording may be off for that one i am trying to remeber what it exactly says but it is something like that.

u think that is anything to worry about or are they just normal errors


----------



## Byteman (Jan 24, 2002)

Hi- I have same trouble at housecall- just posting this as INFO, not a question! I did this: From Windows Explorer, delete old file in Downloaded Program Files for Housecall Active X control,then: from C:\>WINDOWS> smartdrv 
deltree C:\windows\cookies
" " " \history
\locals~1\tempor~1
del C:\windows\temp
hit Enter after each line, type y to say yes....

Then went back to site.....I had to keep AOL window open and start the download for update files.....and , keep browsing on AOL window, the part that always got stuck for me was at about 95%, it FINALLY finished, took like 20 minutes....then was able to set drives and scan, it did it OK. Yes, the site is very busy, and it only scanned 3300 files when used to do 30000. So, I would say its just network traffic, busy server, site problems. Using IE 6.0- for the scan at housecall, you have to have 4.0 or higher. Keep surfing while the updates attempt to download, thats what finally worked for me. It says this at the housecall site, too. 
I checked my Active X, its fine.


----------



## Mosaic1 (Aug 17, 2001)

Byteman, 

That is very interesting. Mine got stuck at exactly the same spot. 95% After a long wait, I got the message the update had failed. This has never happened to me before. I'll clean out and try again later when it's not so busy. Thanks.

Notre,
Looks like it is their side. Try something else or scan in the middle of the night. An incomplete scan isn't good enough. 


Mo


----------



## notredame888 (May 19, 2002)

the tauscun one came back with no trojans. i had every box checked on the left. so that is good ill keep trying the housecall one also


----------



## Mosaic1 (Aug 17, 2001)

Did you right click on winstart.bat and tmpcpyis.bat and choose edit to open them in Notepad to see what the entries are? If you have renamed them and they are harmless, you might need to name them back.

It looks like you may be OK. Reinstalling programs which freeze is a good idea. If the problem is with a particular program (or programs) itself that might just take care of it. I know I have repaired a couple doing just that. I generally remove the progam and reboot first. Then I reinstall it clean.

If you receive any other errors or have any Internet Problems, make notes and post back. 

I would say you have a good idea. Go with the reinstalls and see how that works out.


----------



## notredame888 (May 19, 2002)

ok ill keep my eye out for any error messages and post them if i get any and no i did not rename them two files so im ok there. thanks again


----------

