# ME System Restore



## bears50 (Apr 18, 2003)

When trying to use System restore the program appears to run through the restore process but them I receive a message indicating the system settings were not changed - not changes to the system were made. I have picked a restore point as requested but it will not restore. Any answers as to why it will not work?

A non-related problem. My system was locking up after several minutes in any program. Why I am not sure. Any suggestions on where to start?


----------



## bandit429 (Feb 12, 2002)

Click the link at the bottom of this post and download then run the startup list program,,Copy all the generated test with your mouse and paste it here in a post so we can look at it.

Click here


----------



## bears50 (Apr 18, 2003)

StartupList report, 4/22/2003, 6:27:24 PM
StartupList version: 1.52
Started from : C:\WINDOWS\TEMP\ICEOWS\VIEWUPD\STARTUPLIST.EXE
Detected: Windows ME (Win9x 4.90.3000)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\LEXPPS.EXE
C:\WINDOWS\SYSTEM\LXSUPMON.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\TEMP\ICEOWS\VIEWUPD\STARTUPLIST.EXE


----------



## bandit429 (Feb 12, 2002)

Thats part of it,,and that part looks ok, but where is the rest,,LOL


----------



## bears50 (Apr 18, 2003)

StartupList report, 4/22/2003, 6:59:10 PM
StartupList version: 1.52
Started from : C:\WINDOWS\TEMP\ICEOWS\VIEWUPD\STARTUPLIST.EXE
Detected: Windows ME (Win9x 4.90.3000)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\LEXPPS.EXE
C:\WINDOWS\SYSTEM\LXSUPMON.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OUTLOOK.EXE
C:\WINDOWS\MSAGENT\AGENTSVR.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\TEMP\ICEOWS\VIEWUPD\STARTUPLIST.EXE

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

ScanRegistry = C:\WINDOWS\scanregw.exe /autorun
SystemTray = SysTray.Exe
EM_EXEC = C:\PROGRA~1\LOGITECH\MOUSEW~1\SYSTEM\EM_EXEC.EXE
LexStart = Lexstart.exe
LXSUPMON = C:\WINDOWS\SYSTEM\LXSUPMON.EXE RUN

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

NVIEW = rundll32.exe nview.dll,nViewLoadHook

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 22/4/2003, 18:19:44)

[Rename]
NUL=C:\WINDOWS\SYSTEM\lxakpprt.dll
NUL=C:\WINDOWS\SYSTEM\lxaktk32.dll
NUL=C:\WINDOWS\SYSTEM\lxaklcns.exe
NUL=C:\WINDOWS\SYSTEM\lxakpm9x.dll
NUL=C:\WINDOWS\SYSTEM\lxaklcnp.dll
NUL=C:\WINDOWS\SYSTEM\lxakls9x.exe
NUL=C:\WINDOWS\SYSTEM\lexbces.exe
NUL=C:\WINDOWS\SYSTEM\lexbces.bak
NUL=C:\WINDOWS\SYSTEM\lexbce.dll
NUL=C:\WINDOWS\SYSTEM\lexbce.bak
NUL=C:\WINDOWS\SYSTEM\lexstart.exe
NUL=C:\WINDOWS\SYSTEM\lexlmpm.dll
NUL=C:\WINDOWS\SYSTEM\lexlmpm.bak
NUL=C:\WINDOWS\SYSTEM\lexlmtmp.dll
NUL=C:\WINDOWS\SYSTEM\lexlmdll.dll
NUL=C:\WINDOWS\SYSTEM\lexlmdll.bak
NUL=C:\WINDOWS\SYSTEM\lxaalmdl.dll
NUL=C:\WINDOWS\SYSTEM\lxablmdl.dll
NUL=C:\WINDOWS\SYSTEM\lxaclmdl.dll
NUL=C:\WINDOWS\SYSTEM\lxadlmdl.dll
NUL=C:\WINDOWS\SYSTEM\lxaelmdl.dll
NUL=C:\WINDOWS\SYSTEM\lxaalmdl.bak
NUL=C:\WINDOWS\SYSTEM\lxablmdl.bak
NUL=C:\WINDOWS\SYSTEM\lxaclmdl.bak
NUL=C:\WINDOWS\SYSTEM\lxadlmdl.bak
NUL=C:\WINDOWS\SYSTEM\lxaelmdl.bak
NUL=C:\WINDOWS\SYSTEM\lxaflmdl.bak
NUL=C:\WINDOWS\SYSTEM\lxaglmdl.bak
NUL=C:\WINDOWS\SYSTEM\lxahlmdl.bak
NUL=C:\WINDOWS\SYSTEM\lxailmdl.bak
NUL=C:\WINDOWS\SYSTEM\lxajlmdl.bak
NUL=C:\WINDOWS\SYSTEM\lxaklmdl.bak
NUL=C:\WINDOWS\SYSTEM\lxallmdl.bak
NUL=C:\WINDOWS\SYSTEM\lxamlmdl.bak
NUL=C:\WINDOWS\SYSTEM\lxanlmdl.bak
NUL=C:\WINDOWS\SYSTEM\lxaolmdl.bak
NUL=C:\WINDOWS\SYSTEM\lxaplmdl.bak
NUL=C:\WINDOWS\SYSTEM\lxaqlmdl.bak
NUL=C:\WINDOWS\SYSTEM\lxarlmdl.bak
NUL=C:\WINDOWS\SYSTEM\lxrolmon.dll
NUL=C:\WINDOWS\SYSTEM\lexdlls.dll
NUL=C:\WINDOWS\SYSTEM\lexip32.dll
NUL=C:\WINDOWS\SYSTEM\lexnw32.dll
NUL=C:\WINDOWS\SYSTEM\lexipx32.dll
NUL=C:\WINDOWS\SYSTEM\lexusb32.dll
NUL=C:\WINDOWS\SYSTEM\lexusb32.bak
NUL=C:\WINDOWS\SYSTEM\lexp2p32.dll
NUL=C:\WINDOWS\SYSTEM\lexpps.exe
NUL=C:\WINDOWS\SYSTEM\lexpps.bak
NUL=C:\WINDOWS\SYSTEM\lexnetui.hlp
NUL=C:\WINDOWS\SYSTEM\lexnetui.dll
NUL=C:\WINDOWS\SYSTEM\lexuires.dll
NUL=C:\WINDOWS\SYSTEM\lexlmui.dll
NUL=C:\WINDOWS\SYSTEM\lexbcelm.dll
NUL=C:\WINDOWS\inf\lexusb.inf
NUL=C:\WINDOWS\inf\other\lexusb.inf
NUL=C:\WINDOWS\SYSTEM\lexusb.sys
NUL=C:\WINDOWS\SYSTEM\LXSUPMON.EXE
NUL=C:\WINDOWS\SYSTEM\LXSUPMON.DLL
NUL=C:\WINDOWS\SYSTEM\LXSMUNIN.DLL
NUL=C:\WINDOWS\SYSTEM\LXSMUNIN.EXE

--------------------------------------------------

C:\AUTOEXEC.BAT listing:

SET windir=C:\WINDOWS
SET winbootdir=C:\WINDOWS
SET COMSPEC=C:\WINDOWS\COMMAND.COM

--------------------------------------------------

C:\WINDOWS\WINSTART.BAT listing:

C:\WINDOWS\tmpcpyis.bat

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - C:\WINDOWS\SYSTEM\NZDD.DLL - {EBCDDA60-2A68-11D3-8A43-0060083CFB9C}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Tune-up Application Start.job
PCHealth Scheduler for Data Collection.job
Maintenance-Defragment programs.job
Maintenance-ScanDisk.job
Maintenance-Disk cleanup.job

--------------------------------------------------

Enumerating Download Program Files:

[CV3 Class]
InProcServer32 = C:\WINDOWS\SYSTEM\WUV3IS.DLL
CODEBASE = http://windowsupdate.microsoft.com/R755/V31Controls/x86/mil/en/actsetup.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[Update Class]
InProcServer32 = C:\WINDOWS\SYSTEM\IUCTL.DLL
CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37587.3174537037

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

WebCheck: C:\WINDOWS\SYSTEM\WEBCHECK.DLL
UPnPMonitor: C:\WINDOWS\SYSTEM\UPNPUI.DLL
AUHook: C:\WINDOWS\SYSTEM\AUHOOK.DLL

--------------------------------------------------
End of report, 6,117 bytes
Report generated in 0.028 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

Sorry. I didn't see the rest.


----------



## bandit429 (Feb 12, 2002)

Oh thats ok. 

Tell me where is PC health? Its not in your startup so it must be unchecked in msconfig. Thats part of your system restore.

You have no antivirus? And no firewall? I don't see anything obvious other than maybe you had a printer problem but that does'nt mean there is'nt a virus there, There is a free online scan at the link below. Go get a scan and come back with the result. Then we can work on getting the restore working. It would do no good to try and restore without doing that first,, if a virus is present it would only restore the virus as well,,,they tend to infect the files that you restore from too.

http://www.pandasoftware.es/activescan/activescan-com.asp


----------



## bears50 (Apr 18, 2003)

I did have an anti virus until recently but I deleted it thinking it may have been part of the lockup problem.

I will check PC health in msconfig.


----------



## bears50 (Apr 18, 2003)

I checked both pc health and state mgr. both are associated with PC health. However neither has any effect on the ability to restore the computer. The program will still not function. I get the same messages as before.......there have been no changes to the system.

Any more suggestions? I appreciate your help.


----------



## kilowatt1 (Oct 27, 2001)

Unless you are running multiple monitors on your computer, You need to uncheck NVIEW in msconfig as it can cause ALL types of problems on some systems.

Kilowatt


----------



## bandit429 (Feb 12, 2002)

Having a virus with or without an antivirus is possible,,and will cause lockups and errors, If nview is'nt the problem as Killowatt suggested then a virus scan to ensure a clean system would be in order before attempting a restore. There is'nt anything else in your startup except 

(no name) - C:\WINDOWS\SYSTEM\NZDD.DLL - {EBCDDA60-2A68-11D3-8A43-0060083CFB9C}

And I can't find it classified as spyware,,though it may be.


----------



## bears50 (Apr 18, 2003)

Ok, I have unchecked nview. However the file C:\WINDOWS\SYSTEM\NZDD.DLL I can not seen to locate in my start up files. A. Should I do anything about it and b. How do I get at it to uncheck it?


----------



## bandit429 (Feb 12, 2002)

What was the result of the virus scan??


----------



## bears50 (Apr 18, 2003)

It indicated one infected file but this was located in a personal folder and was an image that I don't believe was a problem. I was running the scan when you left your message.


----------



## bandit429 (Feb 12, 2002)

I put a link at the bottom af the post for you to take a look at,,I just want to be sure,,,A virus and using the restore tool can turn into a major problem,, though it may not be so in this case,,I want to be sure beforehand, There is always a first time for everything .

JUNE 13, 2002

http://www.computerworld.com/securitytopics/security/virus/story/0,10801,71968,00.html


----------



## bears50 (Apr 18, 2003)

The infected file did show up as an image file. I do not recall it being a jpeg file however. The program did indicated it innoculated the file (or something like that). It indicated it was located in a personal file but I could not locate it directly. I may run the scan again and try to locate this particular file. 

Also, I do not recall it being associated with this virus file as listed on the program.


----------



## bandit429 (Feb 12, 2002)

Ok innoculated is good.

Are you running a network there? If not you could go to msconfig and uncheck this startup item. It looks suspicious, but the scan did'nt catch anything so I guess you put it there for a reason.

C:\WINDOWS\MSAGENT\AGENTSVR.EXE

Go to http://www.spywareinfo.com/downloads.php#det , and download 'Hijack This!'. 
Unzip, doubleclick HijackThis.exe, and hit "Scan".
You can have hijack fix this one. You can also save the log and paste it here for review. Be careful as this program does not know the difference between good and bad,, it just shows and removes.

(no name) - C:\WINDOWS\SYSTEM\NZDD.DLL - {EBCDDA60-2A68-11D3-8A43-0060083CFB9C}

Hey there,,,,your online!!!!!!!


----------



## bears50 (Apr 18, 2003)

I do not see this file C:\WINDOWS\MSAGENT\AGENTSVR.EXE
in start up. Any idea how to recognize this?


----------



## bears50 (Apr 18, 2003)

I ran hijack but this file did not show up. Also, the machine locked up just before I downloaded and ran this file.


----------



## bandit429 (Feb 12, 2002)

Well its definintly listed,,its the very reason I was so insistent on a virus scan,,there is a legitimate program with that name. 

I'm gonna hve to research and I think I will ask for help on this one. Evidently you are not aware of installing this. You could do a find file search for 

AGENTSVR.EXE 269KB

Right click it and select properties post the location on your hard drive so we will know where it is located. Also post the size of it.

Maybe we should try a Trojan scan,, I will go find one.

Editted: I did'nt expect hijack would find it,, its not a BHO.


----------



## Mosaic1 (Aug 17, 2001)

Have you installed this patch yet for a problem with Win ME system restore?

http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q290700&

When's the last time you opened the case and cleaned the fans? Made sure they were spinning etc?

Heat can be an issue and Bad RAM.

If this is a heat or Hardware issue.

Have you recently installed any new Hardware or Drivers? Whatever changes can you think of that might coincide with these shutdowns any be of help.

What chipset and CPU do you have on your computer?


----------



## bears50 (Apr 18, 2003)

Ok. Good questions and I have some answers that I was going to give you.

I did open the case about two weeks ago to install a new video card- ASUS G44200 TI 128 meg unit. I cleanned out everything. Problem was this: Prior to installing the new card I downloaded the latest drivers fromASUS and NVidia but did not install them. I then uninstalled the old card- TNT2 and shut the machine down and restarted. Then shut doen again. I then installed the new card booted up the machine and installed the drivers first on the installation disk. Seemed to work ok. Then I installed the new downloaded drivers and the screen went to 640x480 and would not change. Opps! 

So, I tied to determine what was happening with no results. Then I uninstalled the new card and tried to installed the old one again. No luck. I then tried to use the restore feature and I think it worked but with no real changes in the screen display. The screen was still a mess. I called the computer mfg. for tech support and was able to installed the new card with success. It seems to work now except for this occassional lock up concern and Restore does not work. 

I suspect the two problems of lockup and restore problems are interrelated. I thought I would get some tech suggestions on Restore to see if they would lead me to the lock up problem. 

I will try the patch to see if that does anything.

I appreciate your help with this.


----------



## bears50 (Apr 18, 2003)

I a\have another tidbit of information I just discovered. If I use the scoll wheel on my mouse too fast. The machine will lock up. I don't know if that helps anything or not.


----------



## bears50 (Apr 18, 2003)

I downloaded the patch you suggested and now I can not get the restore program to recognize a previous restore point. Any thoughts?


----------



## bandit429 (Feb 12, 2002)

You could try this,, insert a windows ME floppy boot disk,,restart,,,when it stops loading you will see 4 choices I think,,,,,,,choose the one that says minimal boot and hit enter,,when it stops again type these words.

scanreg /restore
A space after scanreg

When it stops you can choose a previous working registry,,choose one date before the problem and hit enter. Follow the onscreen instruction and don't forget to remove the floppy when you restart. This may work.


----------



## bears50 (Apr 18, 2003)

Greqat idea. However, I do not have am ME boot disk. 

Now what do you suggest.


----------



## bandit429 (Feb 12, 2002)

Click the link below and download the OEM for ME,,once downloaded insert a clean floppy and click the file,,It will then make the bootdisk for you.

http://www.mirrors.org/archived_software/www.bootdisk.com/original.htm


----------



## Mosaic1 (Aug 17, 2001)

You should have a startup floppy anyway for emergencies. But in Win ME scanreg /restore can be started from Start>Run


----------



## bears50 (Apr 18, 2003)

Thanks for the suggestions. I have copied onto a floppy the boot disk info. from the suggested web site. I will try your suggestion. I will touch base in a day or so with the rusults. I just do not have time to attemt this today.


----------



## bears50 (Apr 18, 2003)

Ok. I tried booting from the floppy but it is an exe. file. I am not sure it will load this file? It didn't when I tried it.


----------



## bandit429 (Feb 12, 2002)

Down load the EXE to your desktop and insert the blank floppy,,,,,,,then go to the EXE icon and click it,,it automatically makes the disk.. It does this by itself,,don't put the exe on the floppy.


----------



## bears50 (Apr 18, 2003)

I went through a microsoft to make a boot disk. I got to the registry files -cab files- but all were working and they only went back to April 25, 2003 when I added Microsofts restore patch.


----------



## bears50 (Apr 18, 2003)

1. I did reboot after using the boot disk. All registry files were working but only went back as far as 4/25/03. This is the same date as the ME update to the Restore feature was added. 

2. I have still experienced some lock up issues. 

Any more ideas?


----------



## bears50 (Apr 18, 2003)

I guess you haven't read my last message. The machine still locks up. The registry entries appear to be acceptable. Howver they do not date back beyond the April 25 date when the ME restore patch was added.


----------



## bears50 (Apr 18, 2003)

Just wondering if you had any more ideas. 

Am I getting close to having to reformat the hard drive?


----------

