# Solved: Registry checker NIGHTMARE



## rodell (Oct 7, 2004)

This time a real catastrophy. Downloaded a registry checker, all 4mb, from Meta Products (who have not even answered call for help).

At ShutDown and at StartUp I'm presented with blue screen as follows:
Microsoft Registry Checker (MSN non longer supports)
c:\windowa\system.dat
Restore Desktop (check mark OK)
Restoring Devices Listed IN ASP (check mark OK)
RESTORING FILES/FOLDERS (no check mark OK)

After about ten minutes the horizontal progress bar stops at 86%. Then box appears found an error cannot repair. Try reducing number of files , otherwise REINSTALL (a course of action I will do anything to avoid!)

Point is I cannot get out of this screen. No cursor; no boxes of any kind. Must shutsoen, whereupon same thing restarts. At SAFE MODE I deleted anything about Registry with installation date 23AUG05. That is how I am now online. BUT THE SCREEN STILL APPEARS GOING IN OR OUT. Sometimes the error box doesn't appear and I'm in. Sometimes not, and I know not why.

You can see this is a real emergency in dire need of some expertise.

Failing resolution, and even if successfully resolved, please advise exact path at SafeMode that permits restoration (W98SE) to a given date -- in my case 22AUG05.

I dare not shutdown day or night fearing inability to get back. Please help!

Cordially, RO


----------



## Surreal2 (May 21, 2005)

Sorry to hear of your problems. But do take heed of this warning - Registry fixers can often cause problems unless used expertly. Personally, I never use them.

I can suggest one thing to try but it will mean shutting down your computer. The fact that you haven't yet shutdown may be a good thing because Windows backs up the registry when it starts - and each time it does that, older backups are over-written.

Unless other members have better options for you, I'd suggest you shut down the computer, wait a few minutes, then:

Turn the computer on and start tapping the F8 function key immediately.

This should take you to a list of start-up options. Choose 'Safe Mode Command Prompt Only".

When the screen shows the C: prompt, type scanreg /restore (that's scanreg SPACE /restore) and press Enter.

Choose which backup to restore from the list...choose one dated before your latest problems.

Cheers...


----------



## rodell (Oct 7, 2004)

Thank you so much, Surreal2. That path was just what I was looking for. Unless I get advice relating to resolving the problem I'll assuredly go to the work-around (earlier restore). Cordially, RO


----------



## Surreal2 (May 21, 2005)

Good luck...let us know how you get on.

Cheers....


----------



## rodell (Oct 7, 2004)

WHAT I FIND MOST DIFFICULT TO UNDERSTAND IS WHY THE BLUE SCREEN PRESENCE CANNOT BE REMOVED. If I could find its source (online), deleting it should effectively get rid of it because it will not have any source!
As said, I have deleted anything downloaded/installed on date problem began. But STILL it appears. Any ideas you all?


----------



## CouchMaster (May 26, 2003)

rodell said:


> This time a real catastrophy. Downloaded a registry checker, all 4mb, from Meta Products (who have not even answered call for help).
> I dare not shutdown day or night fearing inability to get back. Please help!
> 
> Cordially, RO


You have to reboot the computer in situations like this to unload everything in memory. If it won't start back up then you will have to reinstall the OS.


----------



## rodell (Oct 7, 2004)

Thank you, CouchMaster. My novice status is reasserting itself. Unsure of the meaning here as to rebooting, as well as how to unload everything in memory. When the Registry Checker does its thing, which takes a frustrating 10-15 minutes (a delay not needed in a W98SE on dialup to begin with), all is well. Everything functions normally.
That alone makes me apprehensive as to reinstalling the OS and thereby loosing hundreds of files, as well as programs for which the floppies are stateside while I'm in France. LSemmens info on restoring from SafeMode ton an easrlier date is certainly preferable. Then I only have to update some Excel files -- an endurable nuisance.
Simply do not understand why that damn blue screen can not be removed. Obviously no need for it in the first place. Everyhing else can be removed easily; why not it?
Cordially, RO


----------



## Surreal2 (May 21, 2005)

Hi Rodell - you should not lose your Excel data files just by restoring the registry.

The Windows registry contains system information and user information. If you have installed programs and/or you have customised Windows or program settings since the previous good registry you will lose these and will have to reinstall the programs and/or re-do the changes to the settings, but the registry does not 'store' your data files.

IMPORTANT - Windows 98SE automatically saves a new backup copy of the registry every time it starts. By default, it saves five backups, and when a new one is created the oldest is discarded. So if you are going to attempt a restore, you should do this soon, because if you restart the computer too many times you'll end up with copies of the corrupt registry.


----------



## rodell (Oct 7, 2004)

Thank you, Surreal2, for valuable education not found in the manuals, or even the KBs.
The aphorism, Live & Learn bites again. At SafeMode Restore, only three dates, 8/29/25/24. Desperately needed 8/23 not there. Anyway selected the 8/24 with result: System Restore Failed. (Perhaps similiar result even if had the needed 8/23!)

Is it possible to go further back with MS-Dos? I tried, but could not enter correct path to do anything. Was trying to get to Accessories/System/Tools -- or wherever else you direct me to.

I was wrong to atttribute problem to MetsProducts. Searching and researching I found for sure the origin: PC TOOLS. Messaged them yesterday, Sunday, so that plus time differential means no answer before tomorrow; always assuming they will answer.

So still face 20 minute StartUp time to reach the 86% before can load programs -- plus thre inebriated cursor -- makes for a repetitive constant irritant. But at least I can get Online, and have not had to go through the Reinstall trauma.

Any (additional) suggestions? Cordially, RO

PS: I note under title MSN Registry Checker: Repairing c:\Windows\System.DAT. As I found out this is a 10mb program with hundresd of rows. Is it likely one of the pay programs such as Error Nuker (advertised on TECHGUY, along with others) can resolve this problem?


----------



## Surreal2 (May 21, 2005)

Only three backups? Strange.

OK...another thing to try...boot to command prompt again and type:

scanreg /fix

This command should repair damaged portions of the registry. It'll probably take a while to run, then it will report on what actions it's taken.


----------



## rodell (Oct 7, 2004)

Continuous thanks, Surreal2. Agree; I expected 5 dates, although very doubtful one as far back as 22AUG05. Learned my lesson.

Yes you have mentioned scanreg /fix but was unsuccessful accessing because of location "boot to command prompt". Precisely where is it? (Someone has saying, There are no dumb questions but they're a lot easier to answer.) 
Cordially, RO


----------



## Surreal2 (May 21, 2005)

rodell said:


> you have mentioned scanreg /fix but was unsuccessful accessing because of location "boot to command prompt". Precisely where is it?
> Cordially, RO


Hi Rodell - I meant exactly as you did when you ran the scanreg /restore command...ie:

Turn the computer off, then turn it on and start tapping the F8 function key immediately, which will take you to the list of start-up options. Choose 'Safe Mode Command Prompt Only".

When the screen shows the C: prompt, type

scanreg /fix

(that's scanreg SPACE /fix) and press Enter.

As I said, this command should repair a damaged registry and may take a while to run. Let it finish and it'll tell you what it's done.

Then try restarting the computer as normal.

Cheers...


----------



## Surreal2 (May 21, 2005)

Oops..just saw your PMs and it looks like you managed to run the scanreg /fix command. Is the computer working now?

As to your question about other programs, I don't use any Registry cleaners since the last time I tried one I ended up with big problems. I haven't used the two progs you mentioned so I can't comment on them...maybe other members can advise you if you post the question as a new thread topic.


----------



## rodell (Oct 7, 2004)

Hi mentor Surreal2.
No, the StartUp blue screen still appears, and that despite the 50 corrections of Free Registry Fix and I've forgotten how many on the trial run of Errorchekker. Not exactly purchase-inspiring is it? Wish I'd known of your experience with Registry cleaners beforehand. 
The scanreg fix, contrary to your comment, did not take a long time. That leads me to try again but what I meant about location uncertainty was "...when screen shows C: prompt ..." MY dumb question was where does it appear? I didn't see it.Will await reply becaiuse if I ShutDown and do the SafeMode, that wait plus 10-15 min to redtart with that damn blue scree will take awhile.

Lastly, you made no mention of the MS-Dos use if that can help (see my prior email).


----------



## Surreal2 (May 21, 2005)

OK..I think things are getting more and more confusing. First of all, when you enter the command scanreg /fix or scanreg /restore from the command prompt, you are in DOS and they are DOS commands.

Let's start again...can you describe step by step what you did when you entered the scanreg commands we've been discussing. I need to know exactly where you entered these commands.


----------



## rodell (Oct 7, 2004)

Thanks, I've lost track as you can well imagine. What I'll do is go to it now and note carefully each step. Be back tomorrow with results. Cordially, RO


----------



## Surreal2 (May 21, 2005)

OK..that'll be good. Just to clarify one more point, when I referred to THE C: prompt I was using slightly shorthand terminology. You won't actually see 'C: prompt' on the screen. The command prompt will look like either:

C:\>_

or possibly

C:\windows>_

In both cases the underscore _ character will be blinking on and off. When you see one of these lines you are in DOS and these are 'command prompts'..ie the system is waiting (prompting) for you to enter a command.


----------



## rodell (Oct 7, 2004)

Here it is, Surreal2:
1. ShutDown; Restart MS-Dos
2. c:\windows: (blinking dash) typed scanreg \fix
3. BLUE SCREEN MSN Registry Checker

Repairing c:windows\system.DAT
checked Looking valid system registry keys
checked Checking system registry structure
>> REBUILDING SYSTEM REGISTRY (Horizontal guage, moving % entry, requres 15 min to ewach 86% whereupon box: Error coiuld not fix/reduce files/reinstall windows ...). Press ENTER, c:\windows _ (blinking)

4. typed scanreg \fix.
5. Windows Registry Checker (black screen)
Usage : scanreg [/,options.]

BACK UP : BackUp registry & related system configuration files.
RESTORE  : Choose BackUp to restore
FIX : Repair the registry
Comments="<comment>"
: Adds specified comment to cab file while backing up.

6. c:\windows>_ (blinking)

I typed several entries such as "restore", such as "sysreg \fix" . Invarably the response was "Bad Command or File Name.

Manual turn off/restarts/blue screen (another 15 min!)

Look forward (tomorrow) to your instructions. Cordially, RO


----------



## Surreal2 (May 21, 2005)

Hi Rodell...sorry to say that this doesn't look good. It may be that the initial use of the registry checker you downloaded has corrupted the registry beyond repair.

At this stage, I'm going to see if I can get another member, who's more expert than me in this area, to join the thread and offer more advice.

Please be patient for a bit...and in the meantime don't do anything else to try fixing the computer

Cheers....


----------



## Bob Cerelli (Nov 3, 2002)

I think the / is going the wrong way.

It should be scanreg /fix


----------



## Rollin' Rog (Dec 9, 2000)

While you are putting the slash in the wrong direction in your post here, you must have done it correctly at first -- since the registry fix tool did run.

What exactly is the startup problem when you try to start normally?

This "message" is not a standard Windows "blue screen", but must be associated with the program you installed:



> At ShutDown and at StartUp I'm presented with blue screen as follows:
> Microsoft Registry Checker (MSN non longer supports)
> c:\windowa\system.dat
> Restore Desktop (check mark OK)
> ...


Try choosing Safe Mode mode from the numbered boot menu you get when pressing the ctrl key on startup.

Is that program still in Add/Remove programs? Remove it. Or run *msconfig* from Safe Mode and see if it is present under the startup or autoeexec.bat tabs and UNcheck it from there.


----------



## Bob Cerelli (Nov 3, 2002)

rodell,

Was just checking back through some e-mail and you sent me this past Saturday. 

Apparently all this started after you downloaded and ran "Registry Mechanics, all 4 mb, from PC Tools"

From that same e-mail, also apparently "At SafeMode I deleted anything about Registry with installation date 23AUG05, including this 4 mb program. That is how I am now online"

Did you get this error immediately after installing and using the program?

Did you try to uninstall it through Add/Remove Programs or just from the registry?

Have you looked at MSCONFIG / Startup to see what was starting automatically that would relate to this program and remove it.

How did you determine the dates when you were manually cleaning out the registry?


----------



## rodell (Oct 7, 2004)

Bob, Here's answers and thanks for your interest -- as well as Surreal2 & Rolling'Rog:

1. Negative; ran it and it did find a slew of "problems"; did not buy so they weren't 
cleared. I removed it SafeMode because at StartUp the blue screen appeared and at that time I could not do anything about its report of one unfixable error, etc. No cursor or any boxes, which is why had to go to to Safe Mode. 
2. Thereafter I removed at Add/Remove Programs. Could do so because after 
a 15 min wait while it does Looking/Checking/REBUILDING, Return lets it go on normally.
3. Frequently check msconfig to reduce startup items; none of the listing relates to Registry Checker.
4. I knew the dates because they were current, but I do not recall manual cleanup.

Moderator: 1. Still ignorant of slant directions. Done correctly only by accident.
2.The StartUp problem is twiddling my thumbs for 15 min waiting for that damn blue screen to do its thing. Once it has everything OK, but of course on DialUp I'm still slow
3. You bet, program is Registry Checker from PCTOOLS. WOULD YOU BELIEVE I'VE HAD NO RESPONSE FROM ANY OF 3 MESSAGES SENT FROM THEIR WEBSITE?

Surreal2: 1. I did download Free Registry Check because it is an MSN program (although no longer supported). Hasn't done anything so far as fixing what it finds because I haven't bought it. PC WORLD recos several programs but have not downloaded any, and certainly won't. I live in hope of your assistance reference!

Much appreciate interest and help from you all. Cordially, RO


----------



## Rollin' Rog (Dec 9, 2000)

I'm scratching my head wondering how, if it was successfully removed from Add/remove programs, it could continue to run on startup.

Was there a folder for it in Program files, and is it gone now?

If no reference to it under msconfig > startups, how about msconfig > autoexec.bat?

What you might do is start with "step by step confirmation" and see what you are asked to run from that.

The difference between "\" and "/" is the difference between a Path and a Switch. In the case of scanreg /restore "/restore" is a "switch" telling the application what option to invoke from its repertoire.


----------



## rodell (Oct 7, 2004)

No, no, Rolling 'Rog, program does NOT run; only that damn blue screen and nothing else to do with it and no means to get any other part of it, of course. That is precisely the basis of my utter dissatisfaction. How is it that a program completely removed can leave any part of it behind, and without any means to terminate? And let's be clear, there was no difficulty removing it. I understand also that bits of removed programs can remain, BUT not bits which display.

There is no doubt of my inexperience and lack of computer knowledge, but I have never heard of a similiar situation and I certainly had no idea it is possible.

Scratch some more! It's past 1 am local, I'm to bed. Thanks again. Cordially, RO


----------



## Rollin' Rog (Dec 9, 2000)

Download and install HijackThis using the "self extractor". Run it and select "do a system scan and save the log file". Then copy/paste the contents of the log to a reply

http://www.thespykiller.co.uk/files/hijackthis_sfx.exe

In addition to the Scanlog, also do this: select "open the misc tools section". Put a check in "list also minor sections". Then click "generate startuplist". Post both the Scanlog and Startup lists.


----------



## rodell (Oct 7, 2004)

Thank you Rolling 'Rog Here's the LOG, now I'll go back and bring up the other:

Logfile of HijackThis v1.99.1
Scan saved at 1:41:41 AM, on 9/1/2005
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\PROGRAM FILES\EXECUTIVE SOFTWARE\DISKEEPER\DKSERVICE.EXE
C:\PROGRAM FILES\COMMON FILES\EPSON\EBAPI\SAGENT2.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\LEXPPS.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\PWRTRAY.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\PROGRAM FILES\WANADOO\TASKBARICON.EXE
C:\PROGRAM FILES\BOOSTER WANADOO\WANADOO_BOOSTER.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\WANADOO\ESPACEWANADOO.EXE
C:\PROGRAM FILES\WANADOO\COMCOMP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\PROGRAM FILES\WANADOO\WATCH.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\HIJACKTHIS\HIJACKTHIS1991.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://home.free.fr/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:7180
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;*windowsupdate.microsoft.com;*windowsupdate.com;download.microsoft.com;codecs.microsoft.com;activex.microsoft.com;liveupdate.symantecliveupdate.com;liveupdate.symantec.com;services.wanadoo.fr;secure.wanadoo.fr;webgen.wanadoo.fr;images.wanadoo.fr;images2.wanadoo.fr;wanadoo.wha.com;wha.wanadoo.fr;pay.www.wanadoo.fr;www.wanadoo.fr;webma...anadoo.fr;musicb.wanadoo.fr;wassup.wanadoo.fr
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\WANADOO\SEARCH~3.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-92EA-EC65A294AE31} - (no file)
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN TOOLBAR\01.01.1601.0\EN-US\MSNTB.DLL
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [PowerTray] PwrTray.EXE
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\WANADOO\TaskbarIcon.exe
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [DkService] C:\Program Files\Executive Software\Diskeeper\DkService.exe
O4 - HKLM\..\RunServices: [SAgent2ExePath] C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O4 - Startup: PowerReg SchedulerV2.exe
O4 - Startup: Booster Wanadoo.lnk = C:\Program Files\Booster Wanadoo\wanadoo_booster.exe
O4 - Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\SYSTEM\E_SRCV02.EXE
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &AOL Toolbar search - res://C:\PROGRAM FILES\AOL TOOLBAR\TOOLBAR.DLL/SEARCH.HTML
O8 - Extra context menu item: Fill Forms &] - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Save Forms &[ - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Customize Menu &4 - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Translate - file://C:\Program Files\Dynamic Toolbar\ALTAVISTA\Cache\SelectedContextTranslation.htm
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZF
O8 - Extra context menu item: Afficher l'image non compressée - res://C:\PROGRAM FILES\BOOSTER WANADOO\WANADOO_BOOSTER.EXE/227
O8 - Extra context menu item: Afficher toutes les images non compressées - res://C:\PROGRAM FILES\BOOSTER WANADOO\WANADOO_BOOSTER.EXE/250
O14 - IERESET.INF: START_PAGE_URL=http://home.free.fr/
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://lw11fd.law11.hotmail.msn.com/activex/HMAtchmt.ocx
O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} - https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab
O16 - DPF: {A97608DD-6999-11D5-9C8C-0010A4F2D6BF} (QCOMCont Class) - http://www.quicken.com/qw2001/qcominst.cab
O16 - DPF: {BE5431D2-0F30-11D4-89D9-00C04F509C0A} (SDCInstaller Class) - http://www.stamps.com/download/us/cab/stamps/stamps.cab?r=0.409881591796875&file=stamps.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IncrediMail) - http://www5.incredimail.com/contents/setup/downloader/imloader.cab
O16 - DPF: {963BE66B-121D-4E6C-BF9F-1A774D9A2E41} - http://moneycentral.msn.com/cabs/pmupdate2.exe
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,21/mcgdmgr.cab
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125} (mhLabel Class) - http://www.pcpitstop.com/mhLbl.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-17.cab
O16 - DPF: {3DC2E31C-371A-4BD3-9A27-CDF57CE604CF} (MSN Money Charting) - http://moneycentral.msn.com/cabs/pmupd806.exe
O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} (iCC Class) - http://www.pcpitstop.com/internet/pcpConnCheck.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/SymAData.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.snapfish.com/SnapfishActivia.cab
O16 - DPF: {92CA8ACC-4E99-4A2A-93F1-B2C5CADC8613} (NMInstall Control) - http://a14.g.akamai.net/f/14/7141/1...taller_activex_en_4.60.38.0_MEGAPANEL_USA.cab
O16 - DPF: {15589FA1-C456-11CE-BF01-000000000000} - http://www.errornuker.com/products/errn2004/installers/default/ErrorNukerInstaller.exe


----------



## rodell (Oct 7, 2004)

Here's the other file, and again, thanks:

StartupList report, 9/1/2005, 1:49:31 AM
StartupList version: 1.52.2
Started from : C:\PROGRAM FILES\HIJACKTHIS\HIJACKTHIS1991.EXE
Detected: Windows 98 SE (Win9x 4.10.2222A)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
* Showing rarely important sections
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\PROGRAM FILES\EXECUTIVE SOFTWARE\DISKEEPER\DKSERVICE.EXE
C:\PROGRAM FILES\COMMON FILES\EPSON\EBAPI\SAGENT2.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\LEXPPS.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\PWRTRAY.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\PROGRAM FILES\WANADOO\TASKBARICON.EXE
C:\PROGRAM FILES\BOOSTER WANADOO\WANADOO_BOOSTER.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\WANADOO\ESPACEWANADOO.EXE
C:\PROGRAM FILES\WANADOO\COMCOMP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\PROGRAM FILES\WANADOO\WATCH.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\HIJACKTHIS\HIJACKTHIS1991.EXE

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\WINDOWS\Start Menu\Programs\StartUp]
PowerReg SchedulerV2.exe
Booster Wanadoo.lnk = C:\Program Files\Booster Wanadoo\wanadoo_booster.exe
EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\SYSTEM\E_SRCV02.EXE

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

PowerTray = PwrTray.EXE
SystemTray = SysTray.Exe
Zone Labs Client = C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
WOOTASKBARICON = C:\PROGRA~1\WANADOO\TaskbarIcon.exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

TrueVector = C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
DkService = C:\Program Files\Executive Software\Diskeeper\DkService.exe
SAgent2ExePath = C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe

--------------------------------------------------

File association entry for .TXT:
HKEY_CLASSES_ROOT\txtfile\shell\open\command

(Default) = c:\windows\NOTEPAD.EXE %1

--------------------------------------------------

Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)

[{89820200-ECBD-11cf-8B85-00AA005B4383}]
StubPath = rundll32.exe advpack.dll,UserInstStubWrapper {89820200-ECBD-11cf-8B85-00AA005B4383}

[>PerUser_MSN_Clean] *
StubPath = c:\windows\msnmgsr1.exe

[PerUser_LinkBar_URLs] *
StubPath = c:\windows\COMMAND\sulfnbk.exe /L

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = rundll32.exe advpack.dll,UserInstStubWrapper {44BBA840-CC51-11CF-AAFA-00AA00B6015C}

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = rundll32.exe advpack.dll,UserInstStubWrapper {7790769C-0471-11d2-AF11-00C04FA35D02}

[>IEPerUser] *
StubPath = RUNDLL32.EXE IEDKCS32.DLL,BrandIE4 SIGNUP

[{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}] *
StubPath = C:\WINDOWS\SYSTEM\updcrl.exe -e -u C:\WINDOWS\SYSTEM\verisignpub1.crl

[{89B4C1CD-B018-4511-B0A1-5476DBF70820}] *
StubPath = c:\WINDOWS\RUNDLL32.EXE c:\WINDOWS\SYSTEM\mscories.dll,Install

[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] *
StubPath = C:\WINDOWS\inf\unregmp2.exe /ShowWMP

--------------------------------------------------

Checking for EXPLORER.EXE instances:

C:\WINDOWS\Explorer.exe: PRESENT!

C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present
C:\WINDOWS\Fonts\Explorer.exe: not present

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 1/9/2005, 0:7:20)

[Rename]
NUL=c:\WINDOWS\TEMP\A~NSISU_.EXE

--------------------------------------------------

C:\AUTOEXEC.BAT listing:

PATH=%PATH%;C:\DOS ;"C:\Program Files\Executive Software\Diskeeper\"
if exist toscd001 c:\Windows\Command\mscdex /D:TOSCD001 /M:10
find "DEVICE=C:\DOS\toscdrom.sys" c:\config.sys > nul
if errorlevel==1 goto _1
goto _continue
:_1
echo DEVICE=C:\DOS\toscdrom.sys >> c:\config.sys
goto _continue
:_continue
SET PATH=%PATH%;c:\PROGRA~1\COMMON~1\ROXIOS~1\DLLSHA~1
Set tvdumpflags=10
C:\WINDOWS\command\scanreg.exe /opt /fix

--------------------------------------------------

C:\CONFIG.SYS listing:

DEVICE=C:\DOS\toscdrom.sys

--------------------------------------------------

C:\WINDOWS\DOSSTART.BAT listing:

if exist toscd001 c:\Windows\Command\mscdex /D:TOSCD001 /M:10

--------------------------------------------------

Checking for superhidden extensions:

.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL - {53707962-6F74-2D53-2644-206D7942484F}
(no name) - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll - {724d43a9-0d85-11d4-9908-00400523e39a}
(no name) - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Tune-up Application Start.job
{9E5B6CDF-5577-11D9-9D3C-444553540001}_default.job
ScanDisk.job
Maintenance-Disk cleanup.job
{F897AA24-BDC3-11D1-B85B-00C04FB93981}_Default.job
{351E09E1-78E3-11D8-9D3B-444553540000}_Default.job
{13069182-C7E7-11D8-9D3C-444553540000}_Default.job
G-Lock Temp Cleaner.job
Spybot - Search & Destroy.job
DEFRAG.job
Auto-scheduled task of Free Registry Fix.job

--------------------------------------------------

Enumerating Download Program Files:

[Hotmail Attachments Control]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\HMATCHMT.OCX
CODEBASE = http://lw11fd.law11.hotmail.msn.com/activex/HMAtchmt.ocx

[{4E888414-DB8F-11D1-9CD9-00C04F98436A}]
CODEBASE = https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab

[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\DIRECTOR\SWDIR.DLL
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab

[QCOMCont Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\QCOMCTL1.DLL
CODEBASE = http://www.quicken.com/qw2001/qcominst.cab

[SDCInstaller Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\SDCINSTALL.DLL
CODEBASE = http://www.stamps.com/download/us/cab/stamps/stamps.cab?r=0.409881591796875&file=stamps.cab

[IncrediMail]
CODEBASE = http://www5.incredimail.com/contents/setup/downloader/imloader.cab

[{963BE66B-121D-4E6C-BF9F-1A774D9A2E41}]
CODEBASE = http://moneycentral.msn.com/cabs/pmupdate2.exe

[QDiagAOLCCUpdateObj Class]
InProcServer32 = C:\WINDOWS\SYSTEM\QDIAGCC.OCX
CODEBASE = http://aolcc.aol.com/computercheckup/qdiagcc.cab

[PCPitstop Utility]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\PCPITSTOP.DLL
CODEBASE = http://pcpitstop.com/pcpitstop/PCPitStop.CAB

[McAfee.com Operating System Class]
InProcServer32 = C:\WINDOWS\SYSTEM\MCINSCTL.DLL
CODEBASE = http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab

[{BCC0FF27-31D9-4614-A68E-C18E1ADA4389}]
CODEBASE = http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,21/mcgdmgr.cab

[GDIChk Object]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\GDICHK.DLL
CODEBASE = http://www.microsoft.com/security/controls/GDI/0/GDIChk.CAB

[mhLabel Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\MHLBL.DLL
CODEBASE = http://www.pcpitstop.com/mhLbl.cab

[EPUImageControl Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\EPUWALCONTROL.DLL
CODEBASE = http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-17.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash5r42.cab

[Office Update Installation Engine]
InProcServer32 = C:\WINDOWS\OPUC.DLL
CODEBASE = http://office.microsoft.com/officeupdate/content/opuc2.cab

[MSN Money Charting]
InProcServer32 = C:\PROGRAM FILES\MICROSOFT MONEY 2006\MNYCOREFILES\PRTSTB06.DLL
CODEBASE = http://moneycentral.msn.com/cabs/pmupd806.exe

[iCC Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\PCPCONNCHECK.DLL
CODEBASE = http://www.pcpitstop.com/internet/pcpConnCheck.cab

[ActiveDataInfo Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\SYMADATA.DLL
CODEBASE = https://www-secure.symantec.com/techsupp/asa/SymAData.cab

[LSSupCtl Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\LSSUPCTL.DLL
CODEBASE = https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab

[MsnMessengerSetupDownloadControl Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\MSNMESSENGERSETUPDOWNLOADER.OCX
CODEBASE = http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab

[Snapfish Activia]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\SNAPFISHACTIVIA1000.OCX
CODEBASE = http://www.snapfish.com/SnapfishActivia.cab

[NMInstall Control]
InProcServer32 = C:\WINDOWS\SYSTEM\NMINST~1.DLL
CODEBASE = http://a14.g.akamai.net/f/14/7141/1...taller_activex_en_4.60.38.0_MEGAPANEL_USA.cab

[{15589FA1-C456-11CE-BF01-000000000000}]
CODEBASE = http://www.errornuker.com/products/errn2004/installers/default/ErrorNukerInstaller.exe

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

WebCheck: C:\WINDOWS\SYSTEM\WEBCHECK.DLL

--------------------------------------------------
End of report, 11,247 bytes
Report generated in 0.253 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
 /full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only


----------



## Rollin' Rog (Dec 9, 2000)

Go to Start > Run and enter *sysedit*

In your Autoexec.bat file, just blank out this line:

*C:\WINDOWS\command\scanreg.exe /opt /fix*

then close the file and accept the change when prompted.

I don't know how it got there, it's a Windows command, it might have been placed by the program you installed and not removed properly.

By the way, this should only have been running at startup. If something is happening at shutdown, we are still missing something. If you are "restarting" though, it will run.


----------



## rodell (Oct 7, 2004)

Rolling 'Rog: As you probably know, BeLarc Asvisor PC Audits has (also) comprehensive 4-page listing of everything in the computer. Can send if you want but due to its length don't want to do it without your request.
Cordially, RO


----------



## Rollin' Rog (Dec 9, 2000)

Nope, if it's the "registry checker" running on startup -- that should fix it.

The "Startuplist" shows everything that would conceivably run at startup that might cause this.

By the way, I do not see 'Scanregistry' enabled here. This SHOULD be present in *msconfig* > Startups.

Please run msconfig and look under the startup tab for it. Check it if it is unchecked. It runs invisibly and backs up your registry once each first boot of the day.


----------



## rodell (Oct 7, 2004)

Rollin' Rog: Deleted the designated Windows Command ... file but goofed at the box Save; believe I confirmed deletion instead of saving. 
On to your next much-appreciated reply.

Cordially,


----------



## Rollin' Rog (Dec 9, 2000)

When you make a change to a file, and close the file, you are prompted if you want to keep the change.

If you "okayed" the change, that's all you need to do. To confirm that the line is no longer there, just run *sysedit* again. Even if autoexec.bat itself is no longer there -- no big deal -- Windows does not need anything in that file to run.


----------



## rodell (Oct 7, 2004)

Rollin' Rog: Scanregistry was not checked but it is now. But did not restart because of the 15 min delay to get back and to get online thereafter.

Unsure re the Nope... Understand notn interested in the BeLarc file, but not how this relates to the rest of your sentence. Don't bother to explain unless it's important.

Now to your just-arrived latest message!

Cordially,


----------



## rodell (Oct 7, 2004)

Thanks, Rollin' Rog: I had already rerun and it's not there.

Cordially,


----------



## Rollin' Rog (Dec 9, 2000)

Well, restart now and see what happens.

I can't see anything that would run the registry checker other than what was in autoexec.bat.

Scanregistry does not perform like that.


----------



## rodell (Oct 7, 2004)

OK, Shutting Down and will advise status at StartUp. You can believe In have more than fingers crossed!

Cordially,


----------



## Rollin' Rog (Dec 9, 2000)

There is something I missed:

Auto-scheduled task of Free Registry Fix.job

This is in Task Scheduler. However I do not see Task Scheduler actually present as a startup.

Nonetheless, the "task" should be deleted.

Start > Programs > Accessories > System Tools > Scheduled Tasks.

You should find it there. Just right click on it and delete it.


----------



## rodell (Oct 7, 2004)

OK GENIUS, PROBLEM SOLVED (guess that's why you're the Moderator!).
For my benefit and many others who have tried unsuccessfully to do what you did, will you be so kind as to provide a brief description of cause/cure?

After the explanation please close the thread -- at long last. Then I'll open another in an effort to get rid of my inebriated cursor which spontaneously slides all over the screen. Yes, takes much nerve to further bother you, but what else can I do here in this small French village with no other source of expertise?

Cordially,


----------



## rodell (Oct 7, 2004)

DONE, thank you. 
Is there anything in the HJT LOG I need to fix, or deal with in any other way?

Cordially,


----------



## Rollin' Rog (Dec 9, 2000)

Well, your registry program placed a "scheduled task" to "fix" the registry: a command line in autoexec.bat to run the Windows registry checker.

That line was left there after you uninstalled the program -- a sign of a badly written uninstall routine.

You still should delete the residual entry in the Task Scheduler (see my last post), even though it is not starting. If you were to start it, it might replace the entry in autoexec.bat

We don't "close" threads normally, but we do mark them "Solved" -- something you can do yourself using the Thread Tools menu if all is well.

You're most welcome for the help.

When you open the "cursor" thread, let us know what kind of "mouse" you are using (optical, ball, wireless...) and whether you have tried removing and reinstalling it.

Such problems can also be video driver related.

*edit*

There are few items in the startup that may or may not be convenient or necessary. Rather than "fix" them, you can UNcheck them in msconfig > startups

Some to consider are

Pwrtray.exe, sagent2.exe, PowerReg SchedulerV2.exe

You can review entries yourself using the links and lists below:

In addition to general Google searches for obscure items, I use these sites frequently:

http://www.sysinfo.org/startuplist.php?type=&filter=&count=100&offset=0
http://www.answersthatwork.com/Tasklist_pages/tasklist.htm
http://computercops.biz/modules.php?name=StartupList


----------



## rodell (Oct 7, 2004)

Much obliged, mentor Rollin' Rog. Will of course do the Solved entry.

FYI, it's a ball mouse on keyboard of Toshiba Portege 7200CTe laptop; manual no help, but did identify as Logitech. Went to them and after much correspondence, bottom line, "not their's"! Only mention to you because I've followed various recos from various sources, including MSN KBs to no avail. Slides more now than a week ago. 

Cordially and gratefully,


----------



## rodell (Oct 7, 2004)

Hi Rollin' Rog: Have delayed entering Solved in belief cannot post messages there once it's so designated. If you have any suggestions re the HJT LOG please post at newly opened thread Inebriated mouse. Thanks.
Cordially,


----------



## Rollin' Rog (Dec 9, 2000)

You can still post to this thread. The "Solved" label does not close it, but just indicates the primary issue is fixed.

I don't have any other suggestions for the Scanlog other than you can experiment using msconfig to reconfigure startups.

Items can be unchecked or rechecked. You would want to leave scanregistry, system tray, your antivirus and firewall checked for routine use.


----------



## rodell (Oct 7, 2004)

I wouldn't dare! Very thought of reconfig raises "goose flesh". Thanks.... until the next time (inebriated mouse?).

Cordially,


----------



## DickL (Dec 8, 2005)

Thank you Rollin Rog!!

I also downloaded and ran Registry Mechanic (RM) 5.0 from PCTools and had the exact same problem as Rodell. The computer would reboot and run the Windows Registry Checker and hang up part way through "Repairing C:\Windows\System.dat Checking System Registry Structure." I also found the added line(C:\Windows\Command\scanreg.exe /opt /fix) in the autoexec.bat. Once I removed that line my computer booted up normally.

I've spent the last day looking all over the web for the fix. I my reading I found some people have observed that Windows Registry Checker bombed when the file size went much above 9 MB (my system.dat file was 9.25 MB).

Isn't scanredw.exe normally run by Windows behind the scene at every bootup? If that is true is there any benefit in running scanreg.exe from the autoexec file?

BTW, I've had an urgent message in to PCTools tech "support" for 2 days without a reply. Someone else I came across with another RM problem said it took them 10 days to reply to his email (the only tech support offered). They said they were very busy because of the editor's choice rating they got from somebody. Do you have any way to get a suggestion to the "editors" in the various magazines - namely have them try to get ahold of tech support and consider that experience before they hand out their rating.

Being a glutton for punishment I reran Registry Mechanic and ran into the same blue screen of Windows Registry Checker death. C:\Windows\Command\scanreg.exe /opt /fix had been added to the autoexec file again. When I deleted the line things went back to normal again.

Needless to say I'm getting rid of Registry Mechanic ASAP. One problem, while it has an uninstall feature, the RM program does NOT show up in the Control Panel Add/Remove Programs. Is running the RM Uninstall program likely to do a better or worse job of getting rid of it completely compared to the Add/Remove program route? The PCTools website doesn't offer any information about uninstalling RM.

Again, many thanks.


----------



## Rollin' Rog (Dec 9, 2000)

You're welcome  

When scanregw runs on bootup I believe all it does is create a registry backup unless it detects registry damage and then attempts to restore a backup --or if no backup exists it may run scanreg /fix and try to repair the existing registry.

scanreg /fix by default does not include the /opt function unless there is over 500 kb of "empty" space in the registry.

If scanreg /fix is blue screening, you might try booting to a command prompt and first running:

scanreg /opt

Or use a registry cleaner to clean a little at a time and then run scanreg /opt afterwards, manually


----------

