# Solved: powrprof.dll file cannot start



## shoeby2

Whenever I start my computer I get the following message:

"The POWRPROF.DLL file cannot start. Check the file to determine the problem."

Any suggestions for getting rid of this?

Thanks for your help.


----------



## Linkmaster

Hi shoeby2, Are you running windows 98??
If so look here:
http://support.microsoft.com/?kbid=188213


----------



## shoeby2

I'm actually running Windows ME - you think I can use the same fix?


----------



## Linkmaster

I think you can try. I keep getting hits to the same thing for ME too


----------



## shoeby2

TW, 

Thanks for the link - I went to the site and extracted the POWRPROF.DLL file but I still keep getting the error message at startup. This message comes up twice:

"Error loading POWRPROF.DLL A dynamic link library (DLL) initialization routine failed."

This is then followed by an error starting program message that says:

"The POWRPROF.DLL file cannot start. Check the file to determine the problem."

I'm not sure what to try next - any suggestions?

Thanks again for your help,
Brian


----------



## Linkmaster

Did you go to start, run type msconfig
Hit ok
Click on the startup tab
Make sure there are check marks next to one or two instances of Loadpowerprofile you see
then hit apply and ok
reboot see if that resolves it


----------



## shoeby2

Just looked at the startup and both loadpowerprofiles are checked and active.


----------



## Linkmaster

Hi shoeby2,
Have you installed any new software or hardware before this error started happening?
Have you ran your antivirus??
Just trying to cover the basics.


----------



## shoeby2

TW,

This error started to show up after I ran Norton Systemworks, the Registry Tracker I believe and it did a clean-up of sorts. I've extracted the dll file from both the C drive and also from my Windows ME disk, but I still get the same errors. 

Thanks, 
Brian


----------



## Linkmaster

when you say extracted from C: drive did you rename the file to:
POWRPROF.old
then put in the new file in the same place. reboot


----------



## shoeby2

I didn't rename to .old so I just did, extracted again, rebooted but I'm still getting the error.


----------



## Linkmaster

Can you open the Power management in control Panel?
Run SYC.exe from the start, run dialog box. See if any other files are corrupt.
If not follow the instructions for the first file but use this one instead:
Powercfg.cpl


----------



## shoeby2

I'm unable to open SYC.exe so I'll try your other suggestion. Do I rename the POWRPROF.dll to old, then extract the Powercfg.cpl file to the system folder?


----------



## Linkmaster

its SFC.exe sorry
No try the SFC first to find if that file is corrupt. Can you open the power Management applet in Control Panel??
Lets see what sfc tells you.


----------



## shoeby2

SFC.exe won't work - says Windows cannot find 'SFC.exe'


----------



## Linkmaster

Well I messed up. ME doesnt have it.Have you tried System restore??
Do you have a restore date before this happened??
When you ran Norton did it backup the files it cleaned. If so restore those back??
It can be found in System Works.


----------



## shoeby2

Sorry it took so long to reply. I did a system restore to a couple of weeks back but the problem is still there.


----------



## eddie5659

Hiya

Have you tried re-registering it?

go to Run and type 

regsvr32 powrprof.dll 

And pressing enter

Regards

eddie


----------



## shoeby2

Hi Eddie, 

I just tried that but I get LoadLibrary("powrprof.dll") failed. GetLastError returns 0x0000045a.

This comes as a pop-up message.

Thanks!


----------



## eddie5659

Okay

Rightclick on the powrprof.dll that you have, and choose properties. Whats the version?

eddie


----------



## shoeby2

It says file version 4.90.3000.0

Thanks for your help,
Brian


----------



## eddie5659

I've managed to get someone to send me a copy of their's, as they use Me as well.

Click on the Private Msg bit in my reply, and send me your email. I'll send you the file, and explain some bits about it.

eddie


----------



## eddie5659

Well, that didn't work.

Now, you said that you have both Loadpowerprofile running in your msconfig.

Try this. 

Untick both, apply and restart. Then, when rebooted, go back in, tick them, and restart again.

Does that help?

eddie


----------



## shoeby2

Hi Eddie, 

I just did as you said, but I still get the error. 

Thanks, 
Brian


----------



## eddie5659

Can you run a virus scan, just to be sure:

http://housecall.antivirus.com/housecall/start_corp.asp

eddie


----------



## shoeby2

Eddie, 

I ran the virus scan but everything is clean. 

Thanks, 
Brian


----------



## eddie5659

Lets see if anything has been changed or replaced somehow, before you tried the replacement.

Go To Windows Explorer, and go to the Windows\System\SFP folder.

Look for Sfplog.txt

See if you can attach it as an attachement, as it may be large.

Also, go to Find Files, and see how many copies of powrprof.dll you have. Search in all files and folders.

eddie


----------



## shoeby2

Ok, here's the attachment of the Sfplog:

Also, with the search, I found 3 instances of the powrprof.dll file. One was in my documents, the copy you had me move there. One was in Windows\System (the new one you emailed to me). And the 3rd one was in Windows\VCM.

Thanks,
Brian


----------



## eddie5659

Had a look at the log and there's no reference to POWRPROF 

Also, this is about the sfplog:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;267282

What it basically says, is that if a new file doesn't match current ones, then it will be moved to \Windows\System\Sfp\Archive directory. However, you say there isn't one there, so thats out.

It may be something in the Registry, so gonna move this to the WinMe forums.

What happens if you untick the options in MSCONFIG, but leave them unticked? Does the message come back on startup?

eddie


----------



## shoeby2

I unclicked both loadpowerprofiles on MSCONFIG and now the two error messages are gone but one last message pops up.

"The POWRPROF.DLL file cannot start. Check the file to determine the problem."

Thanks
Brian


----------



## eddie5659

Lets see if its something else thats causing this.

Go to Control Panel, and dounleclick on Power Management. Does it open?

eddie


----------



## shoeby2

I don't have Power Management but I do have Power Options. Double clicking on it doesn't open it.

Thanks,
Brian


----------



## eddie5659

Okay

Do a search on your pc for Powercfg.cpl

The last letter is a small L. If nothing shows, go to Windows Explorer | Tools | Options

View tab. Tick Show hidden files and folders, apply and ok. Search again.

It should be in the windows\system folder, or maybe system32

If you find it, doubleclick it to see if it will open. If not, have a look at this:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;265371

The file you want to extract is the Powercfg.cpl

eddie


----------



## shoeby2

Hi Eddie, 

I ran through the instructions to restore the Powercfg.cpl file, restarted the computer but still get the error message of

"The POWRPROF.DLL file cannot start. Check the file to determine the problem."

Thanks, 
Brian


----------



## eddie5659

Can you get into Power Options now?

eddie


----------



## shoeby2

Power Options doesn't show up anymore in my Control Panel.


----------



## cat3cm

I'm having the same problems as Brian and have tried everything that was suggested to him. I have no power option in my control panel either, and I'm getting the same error messages as he is. I'm using Windows 98SE... PLEASE help!
Thanks all, Cathie


----------



## eddie5659

Hiya Cathie

For both of you, does the Powercfg.cpl exist still?

eddie


----------



## shoeby2

Yes, my Powercfg file is still in Windows/System


----------



## cat3cm

yes, its still in there.


----------



## cat3cm

By the way..... Hi ya Eddie!.... lol Cathie


----------



## eddie5659

Hiya

Sorry for the late reply, been off this week.

Can you both rightclick on the Powercfg.cpl and choose Properties. Is it set to Read Only?

eddie


----------



## shoeby2

Hi Eddie, 

No, it's not set on Read Only.

Thanks, 
Brian


----------



## ravs

hey guys!

I've been having the same problem with powrprof.dll in Windows Me... and i tried all of the tips that you all posted.. any new ideas??

please let me know!~ i'm sure between all of us we can figure this out....


Thanks a bunch!


Raven


----------



## eddie5659

Hiya

Sorry for the late reply, trying to figure this one out 

Okay, first off, go to Find Files, and look for powrprof.dll

Which folder does it say its in?

Next, lets take a look in the Registry. Don't change anything in there.
Go to Run and type REGEDIT
Locate this key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\Flags

Now, is powercfg.cpl in there? If so, is there a data of 0x00000001 (1)


To exit the Registry, click on the large X at the top right, as normal.

It may/may not have that key, as I'm using XP. Also, checked on my mums, and her's is 98. But, a mate has me, so may check some things out on his if needbe 

Can you all try and regsiter the file again, and see if you come up with the same error again:

go to Run and type 

regsvr32 powrprof.dll 

And press enter


I'll carry on digging 

eddie


----------



## shoeby2

Hi Eddie, 

1. In my search for powrprof.dll it came up 3 times. One was in My Documents (an older version you had me move there), one was in Windows\System and the 3rd was in Windows\VCM.

2. Looking in REGEDIT, under HKEY_LOCAL_MACHINE, all the way down to control panel, there was no folder called Flags and I couldn't find powercfg.cpl.

3. When I try to register the file again, I get the same error of "LoadLibrary("powerprof.dll") failed. GetLastError returns 0x0000045a.

4. Thank you so much for the followup!

Brian


----------



## eddie5659

Just about to go to bed, as its been a long week.....and its only Tuesday 

Okay, had a look on my mums pc, and 98 is similar to me.

Check to see if these are there:

First is the Key, then Name, then Data

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

LoadPowerProfile

Rundll32.exe powrprof.dll,LoadCurrentPwrScheme


HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices

LoadPowerProfile

Rundll32.exe powrprof.dll,LoadCurrentPwrScheme


Do the above show, and if so, are the details the same?

eddie


----------



## shoeby2

"LoadPowerProfile

Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"

These are both named correctly, the only difference is they are under folders named like this:

Run-
RunServices-

They both have a minus after them. The regular Run and RunServices folders don't have them listed at all.


----------



## eddie5659

Looks like we may have somewhere to start.

First off, read this on how to backup the Registry:

http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/199762382617?OpenDocument&src=sec_doc_nam

Now, open up the Registry, and go to the Run folder:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

In there, rightclick in the righthand window, and choose New | String Value.

Type in LoadPowerProfile and press Enter.

Then, rightclick on the LoadPowerProfile, and choose Modify. Change the Value Data to

Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

You can copy/paste the above, as I've copied it from the Registry in the first place 

Do this with the RunServices folder as well.

Now, we'll leave the other entries for the time being, but are there any other values in those folders, the ones with the -?

Also, when finished, close the Registry. Reboot. Do the errors come up?

eddie


----------



## shoeby2

Hi Eddie, 

I seem to be back to square one here. I did everything you said and after rebooting I now get the two RUNDLL message boxes saying "Error loading powrprof.dll A dynamic link library (DLL) initializtion routine failed." 

Along with these two messages is the "Error starting Program" box that says "The POWRPROF.DLL file cannot start. Check the file to determine the problem."

I looked in the Run- and RunServices- folders and there are plenty of other values (22 in Run- and 8 in RunServices-). Can't cut and paste though.

Thanks again, 
Brian


----------



## twiety

Only thing I could come up with (tnx 2 google  ) :

Do you have Toshiba Windows Utilities in the Install/Uninstall list box (Start, Settings, Control Pane, Add/Remove Programs)?

If so, try this

"If a new version of the Toshiba Windows Utilities is installed on top of an existing version, the setup program cannot initialize Registries for the Power Save feature because it may already be running under the existing Utility application. This results in error messages being displayed when the user reboots their machine."

And I could imagine this is not the only program that behaves this way when it is installed before older versions are uninstalled. So you could try to uninstall and install other programs to fix the problem.


----------



## souprshan

I am having a similar problem with windows 98, however, I can't find powrprof.dll ANYWHERE...

My regisrty looks like it should, but I can't find the file on my computer or on my win98 disk. 

I have the powercfg.cpl where you said it should be....

HELP?!?!?!?

Also, each time I turn on my computer, I have to reload the drivers for my video card???


----------



## shoeby2

Twiety, 

I don't have Toshiba Windows Utilities, but thanks for the hint.

Brian


----------



## wintermute13

Brian,

Anything under Run- and RunServices- and the like are things that are disabled via msconfig. I ran across this thread while searching for information on the same problem under Win98SE. I discovered that this lines are missing from my registry completely, so I've probably found the solution to my problem, but I thought I'd point out what the Run- and the like were a result of. Simply use msconfig to enable those lines again, and they'll be moved back to the Run and RunServices folders.

Rod


----------



## wintermute13

Update on my situation: I added the registry settings, and tried all of the suggestions listed thus far, all with no luck. This machine is a customer's, and I'm coming down to the wire on the 1-day turnaround time he was promised, so I'm working as quickly as possible. I hope to have a solution very soon, and will post whatever solution I come up with when I get it done


----------



## shoeby2

Rod, 

Thanks for the info. I went into MSCONFIG and checked any boxes that had LoadPowerProfile listed with it. Restart but I still get the 3 error message boxes. Am I enabling the right lines?

Thanks, 
Brian


----------



## wintermute13

Brian,

There should have been two of them, and they should have been exactly as Eddie indicated. Unfortunately, I fear that just enabling those lines won't solve your problem, as it hasn't solved mine. I'm starting to fear that my only option it to install Widows overtop of itself, but this customer's machine doesn't have enough room. I'm running 98 on this customer's machine, though. Since you're running ME, have you tried booting from an ME boot disk and running scanreg? I'm not sure if it's your solution or not, but it couldn't hurt (much)


----------



## wintermute13

Well, it's been a long day, and I'm about to leave for the weekend. Unfortunately, I did not get this problem resolved, and have to hand this machine off to one of my weekend techs. If he gets the problem resolved, I'll be sure to post the solution when I get in on Monday.


----------



## shoeby2

Thanks for your help!


----------



## eddie5659

Brian

The other values that are in the Run- and RunServices- folders: Are they for different things? Also, how many are in each for the LoadPowerProfile?

I have another idea, but will wait till I get home. The pc's at work are Win2000, but at home one is Win98.

eddie


----------



## wintermute13

Unfortunately, I gave up on this problem. The customer could live with clicking on OK to get by the error, so the machine has left my shop. Beforehand, we did everything we could think of short of a reinstall of Windows. We used registry cleaners, spyware cleaners, even installed Windows over itself (I think Microsoft calls this an "in-place upgrade") all with no luck. Sorry I couldn't be more helpful.


----------



## shoeby2

Thanks for offering your help anyway!

Brian


----------



## shoeby2

Hi Eddie, 

The values in the Run- and RunServices- folders are for a bunch of different things. There are no longer any LoadPowerProfile entries in Run- or RunServices-.

Thanks, 
Brian


----------



## eddie5659

Do they exist in the normal Run and RunServices folder, or are they missing from there?

Gonna get on my mums pc Friday night, for some digging around


----------



## shoeby2

They are in both Run and RunServices folders.

Thanks


----------



## eddie5659

And they're in the folders where they should be, in Windows Explorer?

I'll look on Friday, and see if I can see anything else 

Watch this space 

eddie


----------



## shoeby2

Yeah, everything looks like they are in the right folders.

Thanks Eddie.


----------



## eddie5659

Okay

Just a recap on some things first of all.

You say that you have 2 other copies of powrprof.dll in these folders:

My Documents
Windows\VCM

Now, have a look at this link:

http://www.cnn.com/TECH/computing/9807/20/livingston.idg/

Ignore the fact its Win98, but see if you can follow the steps that are outlined.

eddie


----------



## shoeby2

I actually have 3 copies on my computer. One is in Windows\System which is the copy you had emailed to me, dated October 5, 2003. The second one is in My Documents which is the old one I moved there, dated June of 200. Then there is one in VCM folder which is dated July of 2001. Not sure how or why that one is there.

I printed out the CNN link and tried from Step 1 but there is nothing listed under Start/Programs/Accessories/System Tools/System Information/Tools for Version Conflict Manager. Maybe this is specific for 98? 

So basically I can't find VCM to run to show any files that have 2 different version numbers.

Thanks Eddie,
Brian


----------



## eddie5659

Hmm...

Can you get to the VCM folder, and view the file in there? If so, whats the version?

This is a picture of the program, but if its still not there, we may have to do other things....surprise surprise 

http://www.wown.info/j_helmig/w98vcm.htm

eddie


----------



## shoeby2

The version in my VCM folder is 5.0.910.1900?


----------



## eddie5659

What is the version of the one in the System Folder?


----------



## souprshan

I alos did the VCM and powrprof DID NOT come up - However, there was a long list of things that did...


----------



## shoeby2

The version in the system folder is 4.90.3000.0.

Thanks, 
Brian


----------



## eddie5659

Okay, lets see if this will help.

First off, ensure that the entries in MSCONFIG are ticked (I think they are).
Go to the System folder, and drag the copy out, and place it in another folder, but not the same as My Documents. Just create one for this file.

Now, go to the VCM folder, copy the file thats there, and paste it into the System folder.

Make sure its not set to Read Only, Archive can be ticked.

Reboot, and see if that helps.

eddie


----------



## shoeby2

Eddie, 

I did as you said, rebooted and the two RUNDLL error boxes came up (Error loading powrprof.dll) and a new Error Starting Program box came up saying:

"The SYSTRAY.EXE file is linked to missing export POWRPROF.DLLower_HiberSnooze."

Thanks again,
Brian


----------



## eddie5659

Darn....

Okay, take that file back out, and put it to the VCM folder again, and replace with the one that you took out before.

I've been looking at some things, but as its 2am here, going to bed. Need to get onto my Win98 pc, to check something out, but I'll post tomorrow

eddie


----------



## eddie5659

Now, when you've replaced the file as above, this is what I have found when digging around.

As the PowerOptions aren't working, and this error and file is linked to it, lets have a look at this.

Go to Windows Explorer | Tools | Options

In there, View tab. Tick Show Hidden Files, apply and ok.

Now, go to C:\windows\inf 

and locate this file:

powercgf.inf

Click on the file to highlight it, then whiclst holding the Shift key down, rightclick and choose Open With...

Choose Notepad, and then save it somewhere.

Now, you can either copy/paste the contents in your reply, or an easier way for me to view it, would be to attach it using the Browse option, if you click the Post Reply button, instead of the QuickReply at the bottom.


eddie


----------



## shoeby2

Eddie,

I saved it as a notepad but I'm unable to upload here on the site, it's saying not proper format, even though it's txt. Here is the cut and paste, I know it's probably a pain to read. Let me know another way I can send you the file.

Thanks, 
Brian

[Version]
Signature = "$CHICAGO$"
LayoutFile=Layout.inf, Layout1.inf, Layout2.inf
SetupClass = BASE
[DestinationDirs]
PowerCfg.copy.inf = 17 
PowerCfg.copy.sys = 11 
PowerCfg.del.sys = 11 
[BaseWinOptions]
PowerCfg.base
[PowerCfg.runonce]
AddReg = PowerCfg.ROaddreg
[PowerCfg.user]
DelReg = PowerCfg.HKCUdelreg
AddReg = PowerCfg.HKCUaddreg
[PowerCfg.base]
DelFiles = PowerCfg.del.sys
CopyFiles = PowerCfg.copy.inf, PowerCfg.copy.sys
DelReg = PowerCfg.HKLMdelreg, PowerCfg.HKUdelreg
AddReg = PowerCfg.HKLMaddreg, PowerCfg.HKUaddreg, Hiber.AddReg.Powercfg
[PowerCfg.del.sys]
powercfg.dll
[PowerCfg.copy.inf]
PowerCfg.inf
[PowerCfg.copy.sys]
powercfg.cpl
powrprof.dll
batmeter.dll
[PowerCfg.ROaddreg]
HKLM,Software\Microsoft\Windows\CurrentVersion\Run,LoadPowerProfile,,"Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
HKLM,Software\Microsoft\Windows\CurrentVersion\RunServices,LoadPowerProfile,,"Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
[PowerCfg.HKLMdelreg]
HKLM,Software\Microsoft\Windows\CurrentVersion\Run,LoadPowerProfile
HKLM,Software\Microsoft\Windows\CurrentVersion\RunServices,LoadPowerProfile
[PowerCfg.HKLMaddreg]
HKLM,"Software\Microsoft\Active Setup\Installed Components\{CA0A4247-44BE-11d1-A005-00805F8ABE06}",,,%POWER_POLICY_SETTINGS%
HKLM,"Software\Microsoft\Active Setup\Installed Components\{CA0A4247-44BE-11d1-A005-00805F8ABE06}","IsInstalled",1,1,0,0,0
HKLM,"Software\Microsoft\Active Setup\Installed Components\{CA0A4247-44BE-11d1-A005-00805F8ABE06}","Version",,%PUI_VERSION%
HKLM,"Software\Microsoft\Active Setup\Installed Components\{CA0A4247-44BE-11d1-A005-00805F8ABE06}","Local",,"EN"
HKLM,"Software\Microsoft\Active Setup\Installed Components\{CA0A4247-44BE-11d1-A005-00805F8ABE06}","StubPath",,"RunDLL setupx.dll,InstallHinfSection PowerCfg.user 0 powercfg.inf"
HKLM,"Software\Microsoft\Windows\CurrentVersion\RunOnce","PowerProf Settings",,"RunDLL setupx.dll,InstallHinfSection PowerCfg.runonce 0 powercfg.inf"
HKLM,%KEY_POWERCFG%,"LastID",2,"5"
HKLM,%KEY_POWERCFG%,"DiskSpinDownMax",2,"3600"
HKLM,%KEY_POWERCFG%,"DiskSpinDownMin",2,"3"
HKLM,%KEY_POWERCFG%\GlobalPowerPolicy,"Policies",3,\ 01,00,00,00,01,00,00,00,01,00,00,00,03,00,00,00
HKLM,%KEY_POWERPOLICIES%,,0x00000012
HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Controls Folder\PowerCfg\PowerPolicies\0","Policies",3,\ 01,00,00,00,02,00,00,00,02,00,00,00,02,00,00,00,\ 02,00,00,00,60,09,00,00,58,02,00,00,60,09,00,00,\ 58,02,00,00,32,32,00,00,02,00,00,00,04,00,00,C0,\ 00,00,00,00,02,00,00,00,04,00,00,C0,00,00,00,00
HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Controls Folder\PowerCfg\PowerPolicies\1","Policies",3,\ 01,00,00,00,02,00,00,00,02,00,00,00,02,00,00,00,\ 02,00,00,00,58,02,00,00,58,02,00,00,58,02,00,00,\ 58,02,00,00,32,32,00,00,02,00,00,00,04,00,00,C0,\ 00,00,00,00,02,00,00,00,04,00,00,C0,00,00,00,00
HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Controls Folder\PowerCfg\PowerPolicies\3","Policies",3,\ 01,00,00,00,02,00,00,00,02,00,00,00,02,00,00,00,\ 02,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,5A,5A,00,00,02,00,00,00,04,00,00,C0,\ 00,00,00,00,02,00,00,00,04,00,00,C0,00,00,00,00
[Hiber.AddReg.Powercfg]
[PowerCfg.HKCUdelreg]
[PowerCfg.HKCUaddreg]
HKCU,%KEY_CPL_POWERCFG%\%GLOBAL_POWER_POLICY%,Policies,3,\ 01,00,00,00,03,00,00,00,03,00,00,00,00,00,00,00,\ 03,00,00,00,03,00,00,00,00,00,00,00,02,00,00,00,\ 03,00,00,00,00,00,00,00,02,00,00,00,03,00,00,00,\ 00,00,00,00,03,00,00,00,01,00,00,00,00,00,00,00,\ 03,00,00,00,01,00,00,00,00,00,00,00,01,00,00,00,\ 03,00,00,00,02,00,00,00,00,00,00,C0,01,00,00,00,\ 05,00,00,00,01,00,00,00,0A,00,00,00,00,00,00,00,\ 03,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,12,00,00,00
HKCU,"Control Panel\PowerCfg\PowerPolicies\0",Name,2,%POWER_HOME_OFFICE%
HKCU,"Control Panel\PowerCfg\PowerPolicies\0",Description,2,%POWER_HOME_OFFICE_DESC%
HKCU,"Control Panel\PowerCfg\PowerPolicies\0",Policies,3,\ 01,00,00,00,02,00,00,00,01,00,00,00,00,00,00,00,\ 02,00,00,00,00,00,00,00,00,00,00,00,B0,04,00,00,\ 2C,01,00,00,32,32,00,00,04,00,00,00,04,00,00,00,\ 00,00,00,00,00,00,00,00,84,03,00,00,B4,00,00,00,\ 08,07,00,00,58,02,00,00,01,01,64,50,64,64,00,00
HKCU,"Control Panel\PowerCfg\PowerPolicies\1",Name,2,%POWER_PORTABLE%
HKCU,"Control Panel\PowerCfg\PowerPolicies\1",Description,2,%POWER_PORTABLE_DESC%
HKCU,"Control Panel\PowerCfg\PowerPolicies\1",Policies,3,\ 01,00,00,00,02,00,00,00,01,00,00,00,00,00,00,00,\ 02,00,00,00,01,00,00,00,00,00,00,00,B0,04,00,00,\ 2C,01,00,00,32,32,00,00,04,00,00,00,04,00,00,00,\ 00,00,00,00,00,00,00,00,84,03,00,00,B4,00,00,00,\ 08,07,00,00,58,02,00,00,01,01,64,50,64,64,00,00
HKCU,"Control Panel\PowerCfg\PowerPolicies\3",Name,2,%POWER_PERSONAL_SERVER%
HKCU,"Control Panel\PowerCfg\PowerPolicies\3",Description,2,%POWER_PERSONAL_SERVER_DESC%
HKCU,"Control Panel\PowerCfg\PowerPolicies\3",Policies,3,\ 01,00,00,00,02,00,00,00,01,00,00,00,00,00,00,00,\ 02,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,32,32,00,00,04,00,00,00,04,00,00,00,\ 00,00,00,00,00,00,00,00,58,02,00,00,84,03,00,00,\ 10,0E,00,00,08,07,00,00,00,01,64,64,64,64,00,00
HKCU,"Software\Microsoft\Windows\CurrentVersion\Applets\SysTray",CheckPower,,""
[PowerCfg.HKUaddreg]
HKU,".DEFAULT\Control Panel\PowerCfg\GlobalPowerPolicy",Policies,3,\ 01,00,00,00,03,00,00,00,03,00,00,00,00,00,00,00,\ 03,00,00,00,03,00,00,00,00,00,00,00,02,00,00,00,\ 03,00,00,00,00,00,00,00,02,00,00,00,03,00,00,00,\ 00,00,00,00,03,00,00,00,01,00,00,00,00,00,00,00,\ 03,00,00,00,01,00,00,00,00,00,00,00,01,00,00,00,\ 03,00,00,00,02,00,00,00,00,00,00,C0,01,00,00,00,\ 05,00,00,00,01,00,00,00,0A,00,00,00,00,00,00,00,\ 03,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,12,00,00,00
HKU,".DEFAULT\Control Panel\PowerCfg\PowerPolicies\0",Name,2,%POWER_HOME_OFFICE%
HKU,".DEFAULT\Control Panel\PowerCfg\PowerPolicies\0",Description,2,%POWER_HOME_OFFICE_DESC%
HKU,".DEFAULT\Control Panel\PowerCfg\PowerPolicies\0",Policies,3,\ 01,00,00,00,02,00,00,00,01,00,00,00,00,00,00,00,\ 02,00,00,00,00,00,00,00,00,00,00,00,B0,04,00,00,\ 2C,01,00,00,32,32,00,00,04,00,00,00,04,00,00,00,\ 00,00,00,00,00,00,00,00,84,03,00,00,B4,00,00,00,\ 08,07,00,00,58,02,00,00,01,01,64,50,64,64,00,00
HKU,".DEFAULT\Control Panel\PowerCfg\PowerPolicies\1",Name,2,%POWER_PORTABLE%
HKU,".DEFAULT\Control Panel\PowerCfg\PowerPolicies\1",Description,2,%POWER_PORTABLE_DESC%
HKU,".DEFAULT\Control Panel\PowerCfg\PowerPolicies\1",Policies,3,\ 01,00,00,00,02,00,00,00,01,00,00,00,00,00,00,00,\ 02,00,00,00,01,00,00,00,00,00,00,00,B0,04,00,00,\ 2C,01,00,00,32,32,00,00,04,00,00,00,04,00,00,00,\ 00,00,00,00,00,00,00,00,84,03,00,00,B4,00,00,00,\ 08,07,00,00,58,02,00,00,01,01,64,50,64,64,00,00
HKU,".DEFAULT\Control Panel\PowerCfg\PowerPolicies\3",Name,2,%POWER_PERSONAL_SERVER%
HKU,".DEFAULT\Control Panel\PowerCfg\PowerPolicies\3",Description,2,%POWER_PERSONAL_SERVER_DESC%
HKU,".DEFAULT\Control Panel\PowerCfg\PowerPolicies\3",Policies,3,\ 01,00,00,00,02,00,00,00,01,00,00,00,00,00,00,00,\ 02,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,32,32,00,00,04,00,00,00,04,00,00,00,\ 00,00,00,00,00,00,00,00,58,02,00,00,84,03,00,00,\ 10,0E,00,00,08,07,00,00,00,01,64,64,64,64,00,00
HKU,".DEFAULT\Software\Microsoft\Windows\CurrentVersion\Applets\SysTray",CheckPower,,""
[PowerCfg.HKUdelreg]
HKU,".DEFAULT\PowerCfg"
HKU,".DEFAULT\AppEvents\Schemes\Apps\PowerCfg"
HKU,".DEFAULT\AppEvents\EventLabels\LowBatteryAlarm"
HKU,".DEFAULT\AppEvents\EventLabels\CriticalBatteryAlarm"
[Strings]
KEY_POWERPOLICIES = "SOFTWARE\Microsoft\Windows\CurrentVersion\Controls Folder\PowerCfg\PowerPolicies"
KEY_POWERCFG = "SOFTWARE\Microsoft\Windows\CurrentVersion\Controls Folder\PowerCfg"
KEY_CPL_POWERPOLICIES = "Control Panel\PowerCfg\PowerPolicies"
KEY_CPL_POWERCFG = "Control Panel\PowerCfg"
LOWBATTERY = "Low Battery Alarm"
CRITICALBATTERY = "Critical Battery Alarm"
POWERCFG = "Power Management"
GLOBAL_POWER_POLICY = "GlobalPowerPolicy"
POWER_HOME_OFFICE = "Home/Office Desk"
POWER_HOME_OFFICE_DESC = "This scheme is suited to most home or desktop computers that are left plugged in all the time."
POWER_PORTABLE = "Portable/Laptop"
POWER_PORTABLE_DESC = "This scheme is designed for extended battery life for portable computers on the road."
POWER_PERSONAL_SERVER ="Always On"
POWER_PERSONAL_SERVER_DESC="This scheme keeps the computer running so that it can be accessed from the network. Use this scheme if you do not have network wakeup hardware."
POWER_POLICY_SETTINGS = "Power Policy Settings"
PUI_VERSION = "4,90,0,7"


----------



## eddie5659

Got your email, that was a lot easier 

Okay, had a look thru it, and compared it with the Win98 one. Very different...but I obtained one from my mate who has WinMe.

The only thing that is missing from yours is this line:

HKLM,"System\CurrentControlSet\Control\Session Manager\Power","HiberFilePresent",3,1


I don't think he uses power controls, so this may be a general thing.

So, what we'll try is one of 2 things.

First off, try this:

Try this from the Start | Run box:

RunDLL setupx.dll,InstallHinfSection PowerCfg.user 0 powercfg.inf

And press OK

Does that help you anymore?

If not, we'll try the next thing, but I want to see if that works first 

eddie


----------



## shoeby2

Eddie, 

I cut and paste the following into the Run box:

RunDLL setupx.dll,InstallHinfSection PowerCfg.user 0 powercfg.inf

Restarted the computer but all 3 error messages still come up.

Thanks, 
Brian


----------



## eddie5659

Thats okay, wasnt fully sure it would work.

Okay, go to the Registry, and see if you have this key:

HKLM,"System\CurrentControlSet\Control\Session Manager\Power

If so, on the right, do you something with HiberFilePresent, with a load of numbers?

I've got an export of that key, from a working pc 

eddie


----------



## shoeby2

Eddie, 


No HiberFilePresent, there is AcPolicy and DcPolicy with a bunch of numbers next to it.

Brian


----------



## welshY

Hi all
I had similar problems as you I had error message 
pwerprof.dll missing and winspooldrv error.
I searched everywhere for a solution and finally thought of copying the missing files to a floppy (off my daughters computer).
Then on my computer in the system folder inside windows I deleted them to the recycle bin .
Then copied and pasted off the floppy back into my computer ,
luckily for me it all worked o.k. 
dont know if it will help you at all?
Good luck anyway.


----------



## eddie5659

Hiya and welcome, welshY

I think we've tried that, and it didn't work. Are you on Windows 98 or Me?

Brian: Could you export that key, so I could doublecheck with the one I have here?

Go to the

HKLM,"System\CurrentControlSet\Control\Session Manager\Power

again. Click on File | Export key

Choose somewhere to put it, say My Documents, and call it something you'll recognise it with.

This will then export the key, and will look something like this:

http://tweakhelp.com/image/icon/Registry.gif

Then, send it to my mail again.

eddie


----------



## welshY

Hi Guys ,
I am using ME (upgrade from 98se)
if you need any info from mine you will have to explain step by step as I am not a computer genius!! I cured mine by luck


----------



## eddie5659

Brian

Believe it or not, both files you sent were the same, but thats normal 

Okay, here we go...

First of all, can you confirm if you have the (Default) bit at the top of the folder in the Regsitry?

Now, yours is missing this bit:

"HiberFilePresent"=hex:00

So, what we'll do, is edit the Registry and the INF file. Keep a backup of all, just in case.

So, the Registry

Backup: http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/199762382617

Go the the same folder again, and rightclick on the right, and add this key:

HiberFilePresent

And the data wants to be

00

Now, close the Registry, and lets get to the powercfg.inf

Save a copy of the file to say, My Documents.

Then, rightclick on the original file, and choose Open With...

Choose Notepad.

Locate the part in *Bold*. I've added some other stuff, as markers, if you see what I mean. Its near the bottom...

HKLM,%KEY_POWERCFG%,"LastID",2,"5"
HKLM,%KEY_POWERCFG%,"DiskSpinDownMax",2,"3600"
HKLM,%KEY_POWERCFG%,"DiskSpinDownMin",2,"3"
HKLM,%KEY_POWERCFG%\GlobalPowerPolicy,"Policies",3,\ 01,00,00,00,01,00,00,00,01,00,00,00,03,00,00,00
HKLM,%KEY_POWERPOLICIES%,,0x00000012
HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Controls Folder\PowerCfg\PowerPolicies\0","Policies",3,\ 01,00,00,00,02,00,00,00,02,00,00,00,02,00,00,00,\ 02,00,00,00,60,09,00,00,58,02,00,00,60,09,00,00,\ 58,02,00,00,32,32,00,00,02,00,00,00,04,00,00,C0,\ 00,00,00,00,02,00,00,00,04,00,00,C0,00,00,00,00
HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Controls Folder\PowerCfg\PowerPolicies\1","Policies",3,\ 01,00,00,00,02,00,00,00,02,00,00,00,02,00,00,00,\ 02,00,00,00,58,02,00,00,58,02,00,00,58,02,00,00,\ 58,02,00,00,32,32,00,00,02,00,00,00,04,00,00,C0,\ 00,00,00,00,02,00,00,00,04,00,00,C0,00,00,00,00
HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Controls Folder\PowerCfg\PowerPolicies\3","Policies",3,\ 01,00,00,00,02,00,00,00,02,00,00,00,02,00,00,00,\ 02,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,5A,5A,00,00,02,00,00,00,04,00,00,C0,\ 00,00,00,00,02,00,00,00,04,00,00,C0,00,00,00,00
*[Hiber.AddReg.Powercfg]*
[PowerCfg.HKCUdelreg]
[PowerCfg.HKCUaddreg]

Underneath the *[Hiber.AddReg.Powercfg]* add this line:

HKLM,"System\CurrentControlSet\Control\Session Manager\Power","HiberFilePresent",3,1

On the one I'm looking at, just use the Space bar 4 times, then type or paste it in.

This is what it should look like:



PHP:


[Hiber.AddReg.Powercfg]
    HKLM,"System\CurrentControlSet\Control\Session Manager\Power","HiberFilePresent",3,1
[PowerCfg.HKCUdelreg]
[PowerCfg.HKCUaddreg]

Save as powercfg.inf in the folder that you found it in.

---

However, before you do all that, just let me know about the Default bit in the Registry.

*edit* Is yours the OEM or Retail version of WinMe?

eddie


----------



## eddie5659

welshY 

Are you using the OEM or Retail version?

Thanks

eddie


----------



## welshY

Hi Eddie
I think I am using a retail version 
as in bought it to upgrade from 98se.
Looks to me if lots of people have had this problem judging by the number of "views" compared to other problems.
My problem started when I tried to to defrag the hard drive,
computer would crash every time I tried so Iwent into msconfig and took the ticks out of selective start up (which I had done before).
Couldnt start back up ,eventually did a scanreg/restore and got it going with powerprof.dll missing. I managed to use some of the system got on the net and typed in the missing file name and found this site.
After reading the first few answers I tried as I said copying the file off another and deleting mine then pasting the copy into the folder , luckily it worked .
While trying to get the file back I even tried re-installing windows but it would crash every time .
As a precaution I have now copied my system folder onto cd in case I have this problem again 
Amazing to see how you understand all the files.
welshy


----------



## eddie5659

I think Brian has the Retail version, but I'll wait for his reply. Also, waiting for my mates reply, where I got the files from.

Just found something about the differences in files, etc, so need to doublecheck things before we edit anything 

Getting to understand the files is a bit of learning still. Microsoft don't have an answer to this yet, so I want to solve this one. Its my destiny 

That, and a thread in Software thats been going on for a while 

eddie


----------



## shoeby2

Eddie, 

My version is OEM, upgrade from 98 for a Dell computer.

I do have the Default bit in the Registry that you asked about.

I'm trying to follow your directions but when I find the POWERCFG file in System and open it with Notepad it's all garbage characters that come up, I can't find the Hiber.AddReg.Powercfg line.

Thanks, 
Brian


----------



## eddie5659

Brian

When you saved it to Notepad, and copied/pasted the list here, do you still have that Notepad?

You also sent me it, and its okay for me.

Is that what you're still seeing, or are they different now?

Can you send me what you're getting now?

Thanks

eddie


----------



## shoeby2

Hi Eddie, 

I was away all week for the holidays, sorry for the late reply. The notepad version I sent you earlier should be the same, I haven't changed anything.

Thanks, and Happy New Year!

Brian


----------



## souprshan

I was having the same problem powrprof.dll... I tried extracting it from my windows dicks etc....

What worked for me was copying it off of my husband's computer.

I am using win98 - I can e-mai lyou the file if you don't have access to another machine.

good luck!!


----------



## eddie5659

Hiya souprshan

I think we've tried that. I emailed a version from my mates WinMe pc, and it didn't work. But, it may work what with all the bits and bats we've been doing 

eddie


----------



## eddie5659

Brian

I'm sending you a file by email. Its my mates powercfg.inf, so just save it to another folder.

Then, take the current one that you have in the C:\windows\inf 
and place that in a folder that is seperate from the one that I've sent you.

Then, place the new one back in the C:\windows\inf 

Also, go to the registry, and edit as I mentioned earlier. Don't forget the backup, just in case 

This is what to add:

Go the the HKLM,"System\CurrentControlSet\Control\Session Manager\Power again, and rightclick on the right, and add this key:

HiberFilePresent

And the data wants to be

00

Leave the Default bit in, which I asked you about previosly.

eddie


----------



## shoeby2

Hi Eddie and thanks for the continued support.

I copied over the file you sent me, replacing my POWERCFG.INF with the new one. I backed up the registry and went in to edit.

When I went under the HKLM folder to add the HiberFilePresent it was already there with the data of "00" and the Default bit in, so I just left it there and rebooted but I'm still getting the 3 error messages as usual.

Was that correct to just leave the present HiberFilePreset key there, or should I have deleted it and redid it?

Thanks, 
Brian


----------



## IsItIt

Hey Guys,

Just spent 45 minutes reading about your trouble and then signing on just to tell ya something. I went on-line looking a problem I was having with powrprof.dll and found your problem and wondered if they are related?

I am a VB Developer, and am currently finishing up a program that uses powrprof.dll when I went to Compile my code it says that it could not find any dependency information for this file, a kind of a special problem programmers get to deal with, but it made me think that maybe if I am having this problem, perhaps other developers are having this trouble too!

My point... try to use msconfig to disable as much as you can from starting and then boot up after activating one program at a time, I suspect one of your programs is not calling powrprof.dll correctly.

Hope this helps
IsItIt


----------



## eddie5659

Hiya and welcome, IsItIt

Brian, that sounds an interesting way. Lets see what you have running:

Go to Run and type MSINFO32 
On the left choose Software Enviroment, then Startup Programs. Copy/paste the list here. 

eddie


----------



## shoeby2

Hi Eddie and IsItIt - here's my list. I'm not sure why the P2P keeps showing up, I keep disabling it in MSCONFIG but it keeps coming back!


*StateMgr c:\windows\system\restore\statemgr.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

CVPND	"c:\program files\cisco\vpnclient\cvpnd.exe" start HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

defwatch	c:\progra~1\symant~1\symant~1\defwatch.exe HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

LoadPowerProfile rundll32.exepowrprof.dll,loadcurrentpwrscheme HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

LoadPowerProfile rundll32.exepowrprof.dll,loadcurrentpwrscheme HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

NvCplDaemon rundll32.exec:\windows\system\nvcpl.dll,nvstartup HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

nwiz	nwiz.exe /install HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

P2P NETWORKING	c:\windows\system\p2p networking\p2p networking.exe /autostart HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

PCHealth	c:\windows\pchealth\support\pchschd.exe HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

rtvscn95	c:\progra~1\symant~1\symant~1\rtvscn95.exe HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

ScanRegistry	c:\windows\scanregw.exe /autorun HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

SSDPSRV	c:\windows\system\ssdpsrv.exe HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

StillImageMonitor	c:\windows\system\stimon.exe HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

SystemTray	systray.exe HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

TaskMonitor	c:\windows\taskmon.exe HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

updmgr	c:\program files\common files\updmgr\updmgr.exe HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

vptray	c:\progra~1\symant~1\symant~1\vptray.exe HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


----------



## IsItIt

Try disabling the Symantec stuff. I have had SO much trouble with Symantec on all of my computers.

One at a time.


----------



## shoeby2

I really can't disable the Symantec because I have a corporate edition installed for my connection to work. I agree with you though, Symantec is more trouble than it's worth.


----------



## eddie5659

Okay, lets see...

*StateMgr: Windows ME default for System Restore. Do NOT disable!

CVPND: Sub-system used by Cisco VPN client for making a connection to a remote IPSec server. Keep

defwatch: Detects out-of-date virus definitions for Norton Anti-Virus Corporate Edition and runs the Defwatch Wizard. Only required if you don't update the virus definitions manually on a regular basis. Up to you

LoadPowerProfile: 

NvCplDaemon: Intializes the clock and memory settings on nVidia based graphics cards. Enable if you overclock your card. Up to you

nwiz: Associated with the newer versions of nVidia graphics cards drivers. Allows you to immensely improve desktop layouts by setting preferences and optimizations. However, this isn't necessary for the operation of your system. Not needed.

P2P NETWORKING: see end

PCHealth: This is a "scheduler" and does not turn off PC Health. For more information refer here

http://groups.google.com/groups?q=P...l=en&[email protected]&rnum=1

Not needed.

rtvscn95: Real-time virus scanner component of Norton Anti-Virus Corporate Edition. Keep

ScanRegistry: Keep

SSDPSRV: Simple Service Discovery Protocol (SSDP) and General Event Notification Architecture (GENA) services for network plug and play functionality. Starts up a web server on port 5000. Used by Universal Plug and Play (for network device discovery). To remove this program, open Add/Remove Programs, select either Communications (Me) or Networking Services (XP), and remove the checkmark next to Universal Plug and Play. Not needed.

StillImageMonitor: Stimon.exe enables a USB still-image device (such as a scanner) to initiate data transfer to a program. For example, if your scanning device has a scan button, it may start a program and begin scanning when you press it. Create a shortcut and start it manually when needed if your scanner otherwise fails to scan. May be required for your USB scanner to work - including all HP scanners. Up to you

SystemTray: keep

TaskMonitor: The Task Monitor checks the disk-access patterns of programs when they are started and stores this information in log files in the Applog folder. Task Monitor also records the number of times you use a program. The Disk Defragmenter tool uses this information to optimize your hard disk so that programs that you use frequently are loaded faster. Not required - but can be useful. Note: for Norton Anti-Virus 2002 users, loading TaskMonitor will typically solve many, if not most, of those annoying IE scripting errors (per Symantec's Knowledgebase). Up to you

updmgr: See end, hijacking

vptray: System Tray icon for Norton Anti-Virus Corporate Edition. Gives access to the options available and may not be required. Some users may have problems - refer here:

http://groups.google.com/groups?q=v...&[email protected]

Up to you.

p2p networking.exe: Now, are you using Kazaa, cos I can't help on that actual program, but this file may be an addon for the program.
If you've uninstalled kazaa, then try this for that file:

uninstall P2P Networking through Add/Remove Programs. If/when asked whether you also want to remove Altnet components, say 'Yes'. 
P2P Networking is a totally useless Kazaa add-on, and it's been reported to be responsible for serious system slowdowns.

Subsequently remove the P2P Networking folder in C:\Windows\System32, if still there

Okay, before we do anything below, remove that program above, then go to Start | Run and type MSCONFIG, startup tab. Uncheck the ones you don't want, apply and restart.

Then, as we haven't done this yet, lets see what you have here:

Download Spybot - Search & Destroy from http://security.kolla.de

After installing, first press Online, and search for, put a check mark at, and install all updates. 
Next, close all Internet Explorer and OE windows, hit 'Check for Problems', and have SpyBot remove all it finds.

Then, Go here for the free Ad-aware 6 Personal Build 181: http://www.lavasoft.de/support/download/

Then please launch the program ... on the start-up screen, you will need to first run the Webupdate Feature (globe at the top), or click "check for updates" on the start screen to get the Reference File up to date.

Please use either the Custom Scan with Memory and Both registry scans ON. Also.... make sure that you activate IN-DEPTH scanning.

Then, see that you have these options checked: 
Under Ad-aware 6 Settings, Tweaks, Scanning Engine: 
"Unload recognized processes during scanning." 
Under Ad-aware 6 Settings, Tweaks, Cleaning Engine: 
"Automatically try to unregister objects prior to deletion." 
"Let Windows remove files in use after reboot."

Next ...

Run Ad-aware 6. 
Mark the objects you wish to eliminate for removal. There are many options available with a right-click. 
Make a Quarantine only if you do not have the Auto-Quarantine option ON. 
Then choose "Next" to remove the chosen objects. 
Finally ... Reboot

That ought to get rid of most of your spyware.

When you've done all that, go to http://www.tomcoyote.org/hjt/ , and download 'Hijack This!'. 
Unzip, doubleclick HijackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log" button. 
Press that, save the log somewhere, and please copy & paste its contents to the forum.

It will possibly show other issues deserving our attention, but most of what it lists will be harmless or even required, so do NOT fix anything yet. 
Someone here will be happy to help you analyze the results.

eddie


----------



## shoeby2

Eddie, 

Thanks again for sticking with me. I turned off nwiz, PCHealth and also uninstalled P2P. I also ran all the spyware detectors that you said and deleted objects that came up. I've also posted my HijackThis log.

Brian


----------



## eddie5659

Brian

You haven't posted the log. Just thought I'd reply so you'd get an email 

eddie


----------



## shoeby2

Sorry Eddie, here's my log:

Logfile of HijackThis v1.97.7
Scan saved at 8:41:45 PM, on 2/9/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\SYMANTEC_CLIENT_SECURITY\SYMANTEC ANTIVIRUS\RTVSCN95.EXE
C:\PROGRAM FILES\SYMANTEC_CLIENT_SECURITY\SYMANTEC ANTIVIRUS\DEFWATCH.EXE
C:\PROGRAM FILES\CISCO\VPNCLIENT\CVPND.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\SYMANTEC_CLIENT_SECURITY\SYMANTEC ANTIVIRUS\VPTRAY.EXE
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.earthlink.net/partner/more/msie/button/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.earthlink.net/partner/more/msie/button/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by EarthLink
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://rd.yahoo.com/customize/ymsgr/defaults/su/*http://www.yahoo.com
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_6_0.DLL
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_6_0.DLL
O3 - Toolbar: @msdxmLC.dll,[email protected],&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SSDPSRV] c:\windows\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [rtvscn95] C:\PROGRA~1\SYMANT~1\SYMANT~1\rtvscn95.exe
O4 - HKLM\..\RunServices: [defwatch] C:\PROGRA~1\SYMANT~1\SYMANT~1\defwatch.exe
O4 - HKLM\..\RunServices: [CVPND] "C:\Program Files\Cisco\VpnClient\cvpnd.exe" start
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: AOL Instant Messenger (SM) (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O14 - IERESET.INF: START_PAGE_URL=http://www.sprintsite.com/
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/essentials/ymmapi_0727.dll
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37571.6557060185
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/0fb5e03023def1/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://www.smgradio.com/core/player/abasetup.cab
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://support.dell.com/us/en/systemprofiler/SysProfLCD.CAB
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinstc.cab
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab
O16 - DPF: {88D8E8B7-A33B-4417-A385-8373484D43ED} (InstallHelper Class) - http://survey.prod.there.com/qualsurvey/ThereInstallHelper.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab


----------



## dvk01

there's nothing showing in the log, but before we can remove P2P networking properly it needs to show, that is if you haven'yt already uninstalled it

enable EVERYTHING in MSconfig & post a new HJT log please

what might help, withnthe power problem is post a complete start up list

open HJT/config/misc tools/ tick both boxes about empty & minor sections and generate start up list

that will show all drivers and services and if eddie does the same from his mates ME, you can compare the 2 & see what drivers/services are missing that might cause the power problem


----------



## eddie5659

Thanks Derek, I'll get in touch with him. Not sure if he'll reply soon, what with it being Valentine's weekend 

eddie


----------



## shoeby2

Hi Eddie and Derek,

Here's the posting of my HJT, after running it up against the startup, with the boxes checked that Derek was talking about:

StartupList report, 2/14/2004, 10:27:20 AM
StartupList version: 1.52
Started from : C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE
Detected: Windows ME (Win9x 4.90.3000)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
* Including empty and uninteresting sections
* Showing rarely important sections
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\SYMANTEC_CLIENT_SECURITY\SYMANTEC ANTIVIRUS\RTVSCN95.EXE
C:\PROGRAM FILES\SYMANTEC_CLIENT_SECURITY\SYMANTEC ANTIVIRUS\DEFWATCH.EXE
C:\PROGRAM FILES\CISCO\VPNCLIENT\CVPND.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\SYMANTEC_CLIENT_SECURITY\SYMANTEC ANTIVIRUS\VPTRAY.EXE
C:\PROGRAM FILES\COMMON FILES\PSD TOOLS\CHANNELUP.EXE
C:\WINDOWS\WT\UPDATER\WCMDMGR.EXE
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\WINDOWS\Start Menu\Programs\StartUp]
*No files*

Shell folders AltStartup:
*Folder not found*

User shell folders Startup:
*Folder not found*

User shell folders AltStartup:
*Folder not found*

Shell folders Common Startup:
[C:\WINDOWS\All Users\Start Menu\Programs\StartUp]
*No files*

Shell folders Common AltStartup:
*Folder not found*

User shell folders Common Startup:
*Folder not found*

User shell folders Alternate Common Startup:
*Folder not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

ScanRegistry = c:\windows\scanregw.exe /autorun
TaskMonitor = c:\windows\taskmon.exe
SystemTray = SysTray.Exe
NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup
vptray = C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
wcmdmgr = C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

SSDPSRV = c:\windows\SYSTEM\ssdpsrv.exe
StillImageMonitor = C:\WINDOWS\SYSTEM\STIMON.EXE
*StateMgr = C:\WINDOWS\System\Restore\StateMgr.exe
rtvscn95 = C:\PROGRA~1\SYMANT~1\SYMANT~1\rtvscn95.exe
defwatch = C:\PROGRA~1\SYMANT~1\SYMANT~1\defwatch.exe
CVPND = "C:\Program Files\Cisco\VpnClient\cvpnd.exe" start
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

PSD Tools Channel = C:\Program Files\Common Files\PSD Tools\ChannelUp.exe

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

[OptionalComponents]
*No values found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

--------------------------------------------------

File association entry for .EXE:
HKEY_CLASSES_ROOT\exefile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .COM:
HKEY_CLASSES_ROOT\comfile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .BAT:
HKEY_CLASSES_ROOT\batfile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .PIF:
HKEY_CLASSES_ROOT\piffile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .SCR:
HKEY_CLASSES_ROOT\scrfile\shell\open\command

(Default) = "%1" /S

--------------------------------------------------

File association entry for .HTA:
HKEY_CLASSES_ROOT\htafile\shell\open\command

(Default) = C:\WINDOWS\SYSTEM\MSHTA.EXE "%1" %*

--------------------------------------------------

Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)

[SetupcPerUser] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection SetupcPerUser 64 c:\windows\INF\setupc.inf

[AppletsPerUser] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection AppletsPerUser 64 c:\windows\INF\applets.inf

[FontsPerUser] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection FontsPerUser 64 c:\windows\INF\fonts.inf

[PerUser_ICW_Inis] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_ICW_Inis 0 c:\windows\INF\icw97.inf

[>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] *
StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

[{89820200-ECBD-11cf-8B85-00AA005B4395}] *
StubPath = regsvr32.exe /s /n /i:U shell32.dll

[>PerUser_MSN_Clean] *
StubPath = c:\windows\msnmgsr1.exe

[{CA0A4247-44BE-11d1-A005-00805F8ABE06}] *
StubPath = RunDLL setupx.dll,InstallHinfSection PowerCfg.user 0 powercfg.inf

[PerUser_Msinfo] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_Msinfo 64 c:\windows\INF\msinfo.inf

[PerUser_Msinfo2] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_Msinfo2 64 c:\windows\INF\msinfo.inf

[MotownMmsysPerUser] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection MotownMmsysPerUser 64 c:\windows\INF\motown.inf

[MotownAvivideoPerUser] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection MotownAvivideoPerUser 64 c:\windows\INF\motown.inf

[MotownMPlayPerUser] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection MotownMPlayPerUser 64 c:\windows\INF\motown.inf

[PerUser_Base] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_Base 64 c:\windows\INF\msmail.inf

[ShellPerUser] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection ShellPerUser 64 c:\windows\INF\shell.inf

[Shell2PerUser] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection Shell2PerUser 64 c:\windows\INF\shell2.inf

[PerUser_winbase_Links] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_winbase_Links 64 c:\windows\INF\subase.inf

[PerUser_winapps_Links] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_winapps_Links 64 c:\windows\INF\subase.inf

[PerUser_LinkBar_URLs] *
StubPath = c:\windows\COMMAND\sulfnbk.exe /L

[TapiPerUser] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection TapiPerUser 64 c:\windows\INF\tapi.inf

[{73fa19d0-2d75-11d2-995d-00c04f98bbc9}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection c:\windows\INF\webfdr16.inf,PerUserStub.Install,1

[PerUserOldLinks] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUserOldLinks 64 c:\windows\INF\appletpp.inf

[MmoptRegisterPerUser] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection MmoptRegisterPerUser 64 c:\windows\INF\mmopt.inf

[OlsPerUser] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection OlsPerUser 64 c:\windows\INF\ols.inf

[OlsMsnPerUser] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection OlsMsnPerUser 64 c:\windows\INF\ols.inf

[PerUser_Paint_Inis] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_Paint_Inis 64 c:\windows\INF\applets.inf

[PerUser_Calc_Inis] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_Calc_Inis 64 c:\windows\INF\applets.inf

[PerUser_dxxspace_Links] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_dxxspace_Links 64 c:\windows\INF\applets1.inf

[PerUser_MSBackup_Inis] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_MSBackup_Inis 64 c:\windows\INF\applets1.inf

[PerUser_CVT_Inis]
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_CVT_Inis 64 c:\windows\INF\applets1.inf

[PerUser_Enable_Inis] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_Enable_Inis 64 c:\windows\INF\enable.inf

[MotownRecPerUser] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection MotownRecPerUser 64 c:\windows\INF\motown.inf

[PerUser_Vol] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_Vol 64 c:\windows\INF\motown.inf

[PerUser_MSWordPad_Inis] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_MSWordPad_Inis 64 c:\windows\INF\wordpad.inf

[PerUser_RNA_Inis] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_RNA_Inis 64 c:\windows\INF\rna.inf

[PerUser_Wingames_Inis] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_Wingames_Inis 64 c:\windows\INF\games.inf

[PerUser_Sysmon_Inis] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_Sysmon_Inis 64 c:\windows\INF\appletpp.inf

[PerUser_Sysmeter_Inis] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_Sysmeter_Inis 64 c:\windows\INF\appletpp.inf

[PerUser_netwatch_Inis] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_netwatch_Inis 64 c:\windows\INF\appletpp.inf

[PerUser_CharMap_Inis] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_CharMap_Inis 64 c:\windows\INF\appletpp.inf

[PerUser_Onlinelnks_Inis] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_Onlinelnks_Inis 64 c:\windows\INF\appletpp.inf

[PerUser_Dialer_Inis] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_Dialer_Inis 64 c:\windows\INF\appletpp.inf

[PerUser_ClipBrd_Inis] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_ClipBrd_Inis 64 c:\windows\INF\clip.inf

[MmoptMusicaPerUser] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection MmoptMusicaPerUser 64 c:\windows\INF\mmopt.inf

[MmoptJunglePerUser] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection MmoptJunglePerUser 64 c:\windows\INF\mmopt.inf

[MmoptRobotzPerUser] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection MmoptRobotzPerUser 64 c:\windows\INF\mmopt.inf

[MmoptUtopiaPerUser] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection MmoptUtopiaPerUser 64 c:\windows\INF\mmopt.inf

[PerUser_CDPlayer_Inis] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_CDPlayer_Inis 64 c:\windows\INF\mmopt.inf

[{44BBA842-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection c:\windows\INF\msnetmtg.inf,NetMtg.Install.PerUser.W95

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = rundll32.exe advpack.dll,UserInstStubWrapper {44BBA840-CC51-11CF-AAFA-00AA00B6015C}

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = rundll32.exe advpack.dll,UserInstStubWrapper {7790769C-0471-11d2-AF11-00C04FA35D02}

[OlsAolPerUser] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection OlsAolPerUser 64 c:\windows\INF\ols.inf

[OlsAttPerUser] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection OlsAttPerUser 64 c:\windows\INF\ols.inf

[OlsCompuservePerUser] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection OlsCompuservePerUser 64 c:\windows\INF\ols.inf

[OlsProdigyPerUser] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection OlsProdigyPerUser 64 c:\windows\INF\ols.inf

[Shell3PerUser] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection Shell3PerUser 64 c:\windows\INF\shell3.inf

[Theme_Windows_PerUser] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection Themes_Windows_PerUser 0 c:\windows\INF\themes.inf

[Theme_MoreWindows_PerUser] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection Themes_MoreWindows_PerUser 0 c:\windows\INF\themes.inf

[{44BBA851-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection c:\windows\INF\wpie5x86.inf,PerUserStub

[>IEPerUser] *
StubPath = RUNDLL32.EXE IEDKCS32.DLL,BrandIE4 SIGNUP

[Chl99] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\chl99.inf,InstallUser

[PerUser_HNW_Inis] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_HNW_Inis 64 c:\windows\INF\ICS.inf

[PerUser_moviemaker] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_moviemaker 64 c:\windows\INF\moviemk.inf

[SamplerPerUser] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection SamplerPerUser 64 c:\windows\INF\sampler.inf

[PerUser_PCHealth] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_PCHealth 64 c:\windows\INF\pchealth.inf

[{6BF52A52-394A-11d3-B153-00C04F79FAA6}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub

[PerUser_ZoneGame_Inis] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_ZoneGame_Inis 64 c:\windows\INF\games.inf

[PerUser_PBGame_Inis] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_PBGame_Inis 64 c:\windows\INF\games.inf

[{5945c046-1e7d-11d1-bc44-00c04fd912be}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection c:\windows\INF\msmsgs.inf,BLC.Install.PerUser

[PerUser_DCC_Inis]
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_DCC_Inis_remove 64 c:\windows\INF\rna.inf

[OlsEarthlinkPerUser] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection OlsEarthlinkPerUser 64 c:\windows\INF\ols.inf

[{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}] *
StubPath = C:\WINDOWS\SYSTEM\updcrl.exe -e -u C:\WINDOWS\SYSTEM\verisignpub1.crl

[PerUser_ICS_Inis] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_ICS_Inis 64 c:\windows\INF\ics.inf

[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] *
StubPath = C:\WINDOWS\inf\unregmp2.exe /ShowWMP

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = C:\WINDOWS\SYSTEM\ie4uinit.exe

--------------------------------------------------

Enumerating ICQ Agent Autostart apps:
HKCU\Software\Mirabilis\ICQ\Agent\Apps

*Registry key not found*

--------------------------------------------------

Load/Run keys from C:\WINDOWS\WIN.INI:

load=
run=

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\A_ADAMS.SCR
drivers=mmsystem.dll power.drv

--------------------------------------------------

Checking for EXPLORER.EXE instances:

C:\WINDOWS\Explorer.exe: PRESENT!

C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present
C:\WINDOWS\Fonts\Explorer.exe: not present

--------------------------------------------------

C:\WINDOWS\WININIT.INI listing:
(Created 14/2/2004, 10:25:30)

[Rename]
NUL=c:\WINDOWS\TEMP\A~NSISU_.EXE

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 12/2/2004, 21:47:44)

[Rename]
NUL=c:\program files\earthlink 5.0\[email protected]\cookies\[email protected][2].txt
NUL=c:\program files\earthlink 5.0\[email protected]\cookies\[email protected][1].txt
NUL=c:\program files\earthlink 5.0\[email protected]\cookies\[email protected][1].txt
NUL=c:\program files\earthlink 5.0\[email protected]\cookies\[email protected][2].txt
NUL=c:\program files\earthlink 5.0\[email protected]\cookies\[email protected][2].txt
NUL=c:\program files\earthlink 5.0\[email protected]\cookies\[email protected][2].txt
NUL=c:\program files\earthlink 5.0\[email protected]\cookies\[email protected][1].txt
NUL=c:\program files\earthlink 5.0\[email protected]\cookies\[email protected][1].txt
NUL=c:\program files\earthlink 5.0\[email protected]\cookies\[email protected][1].txt

--------------------------------------------------

C:\AUTOEXEC.BAT listing:

SET PATH=C:\WINDOWS;c:\windows;c:\windows\COMMAND;"C:\Program Files\Common Files\Roxio Shared\DLLShared"
SET BLASTER=A220 I7 D1 H5 P330 T6
SET CTSYN=C:\WINDOWS
C:\PROGRA~1\CREATIVE\SBLIVE\DOSDRV\SBEINIT.COM
SET windir=C:\WINDOWS
SET winbootdir=C:\WINDOWS
SET COMSPEC=C:\WINDOWS\COMMAND.COM
SET PROMPT=$p$g
SET TEMP=C:\windows\TEMP
SET TMP=c:\windows\TEMP
SET PS5ROOT=c:\Program Files\Roxio\Easy CD Creator 6\PhotoSuite\

--------------------------------------------------

C:\CONFIG.SYS listing:

*File is empty*

--------------------------------------------------

C:\WINDOWS\WINSTART.BAT listing:

C:\WINDOWS\tmpcpyis.bat

--------------------------------------------------

C:\WINDOWS\DOSSTART.BAT listing:

C:\PROGRA~1\CREATIVE\SBLIVE\DOSDRV\SBEINIT.COM
echo off
REM Notes:
REM DOSSTART.BAT is run whenenver you choose "Restart the computer 
REM in MS-DOS mode" from the Shutdown menu in Windows. It allows 
REM you to load programs that you might not want loaded in Windows, 
REM (because they have functional equivalents) but that you do 
REM want loaded under MS-DOS. The two primary candidates for 
REM this are MSCDEX and a real mode driver for the mouse you ship
REM with your system. Commands that you want present in both Windows
REM and MS-DOS should be placed in the Autoexec.bat in the 
REM \Image directory of your reference server. Please note that for
REM MSCDEX you will need to load the corresponding real-mode CD 
REM driver in Config.sys. This driver won't be used by Windows 98
REM but will be available prior to and after Windows 98 exits.
REM
REM This file is also helpful if you want to F8 boot into MS-DOS 7.0
REM before Windows loads and access the CD-ROM. All you have to do
REM is press F8 and then run DOSSTART to load MSCDEX and your real
REM mode mouse driver (no need to remember the command line parameters
REM for these two files.
REM
REM - You MUST explicitly specify the CD ROM Drive Letter for MSCDEX.
REM - The string following the /D: statement must explicitly match 
REM the string in CONFIG.SYS following your CD-ROM device driver.
REM MSCDEX.EXE /D:OEMCD001 /l:d
REM MOUSE.EXE

--------------------------------------------------

Checking for superhidden extensions:

.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden

--------------------------------------------------

Verifying REGEDIT.EXE integrity:

- Regedit.exe found in C:\WINDOWS
- .reg open command is normal (regedit.exe %1)
- Company name OK: 'Microsoft Corporation'
- Original filename OK: 'REGEDIT.EXE'
- File description: 'Registry Editor'

Registry check passed

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_6_0.DLL - {02478D38-C3F9-4efb-9B51-7695ECA05670}
(no name) - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Tune-up Application Start.job
PCHealth Scheduler for Data Collection.job
Symantec NetDetect.job
Run Norton System Check.job

--------------------------------------------------

Enumerating Download Program Files:

[Microsoft XML Parser for Java]
CODEBASE = file://c:\windows\Java\classes\xmldso.cab
OSD = C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd

[DirectAnimation Java Classes]
CODEBASE = file://c:\windows\SYSTEM\dajava.cab
OSD = C:\WINDOWS\Downloaded Program Files\DirectAnimation Java Classes.osd

[Internet Explorer Classes for Java]
CODEBASE = file://c:\windows\SYSTEM\iejava.cab
OSD = C:\WINDOWS\Downloaded Program Files\Internet Explorer Classes for Java.osd

[YahooYMailTo Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\YMMAPI.DLL
CODEBASE = http://us.dl1.yimg.com/download.yahoo.com/dl/installs/essentials/ymmapi_0727.dll

[Update Class]
InProcServer32 = C:\WINDOWS\SYSTEM\IUCTL.DLL
CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37571.6557060185

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[{00000055-0000-0010-8000-00AA00389B71}]
CODEBASE = http://codecs.microsoft.com/codecs/i386/fhgax.CAB

[HouseCall Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\XSCAN53.OCX
CODEBASE = http://a840.g.akamai.net/7/840/537/0fb5e03023def1/housecall.antivirus.com/housecall/xscan53.cab

[{E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD}]
CODEBASE = http://www.smgradio.com/core/player/abasetup.cab

[DmiReader Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\SYSPROFLCD.DLL
CODEBASE = http://support.dell.com/us/en/systemprofiler/SysProfLCD.CAB

[YInstStarter Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\YINSTHELPER.DLL
CODEBASE = http://download.yahoo.com/dl/installs/yinstc.cab

[Ofoto Upload Manager Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\AXOFUPLD.DLL
CODEBASE = http://www.ofoto.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab

[InstallHelper Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\THEREINSTALLHELPER.DLL
CODEBASE = http://survey.prod.there.com/qualsurvey/ThereInstallHelper.cab

[iPIX ActiveX Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\IPIXX.OCX
CODEBASE = http://www.ipix.com/viewers/ipixx.cab

[ShellInstaller Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\SHELLI~1.OCX
CODEBASE = http://download.buddylinks.net/ShellInstallerRaptor.cab

--------------------------------------------------

Enumerating Winsock LSP files:

NameSpace #1: c:\windows\SYSTEM\rnr20.dll
Protocol #1: c:\windows\SYSTEM\mswsosp.dll
Protocol #2: c:\windows\SYSTEM\msafd.dll
Protocol #3: c:\windows\SYSTEM\msafd.dll
Protocol #4: c:\windows\SYSTEM\msafd.dll
Protocol #5: c:\windows\SYSTEM\rsvpsp.dll
Protocol #6: c:\windows\SYSTEM\rsvpsp.dll

--------------------------------------------------

Enumerating Win9x VxD services:

VNETSUP: vnetsup.vxd
NDIS: ndis.vxd
JAVASUP: JAVASUP.VXD
CONFIGMG: *CONFIGMG
NTKern: *NTKERN
VWIN32: *VWIN32
VFBACKUP: *VFBACKUP
VCOMM: *VCOMM
COMBUFF: *COMBUFF
IFSMGR: *IFSMGR
IOS: *IOS
MTRR: *MTRR
SPOOLER: *SPOOLER
UDF: *UDF
VFAT: *VFAT
VCACHE: *VCACHE
VCOND: *VCOND
VCDFSD: *VCDFSD
VXDLDR: *VXDLDR
VDEF: *VDEF
VPICD: *VPICD
VTD: *VTD
REBOOT: *REBOOT
VDMAD: *VDMAD
VSD: *VSD
V86MMGR: *V86MMGR
PAGESWAP: *PAGESWAP
DOSMGR: *DOSMGR
VMPOLL: *VMPOLL
SHELL: *SHELL
PARITY: *PARITY
BIOSXLAT: *BIOSXLAT
VMCPD: *VMCPD
VTDAPI: *VTDAPI
PERF: *PERF
VNETBIOS: vnetbios.vxd
VPOWERD: *VPOWERD
Flash9x: flash9x.vxd
NDISWAN: ndiswan.vxd
VREDIR: vredir.vxd
DFS: dfs.vxd

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

WebCheck: C:\WINDOWS\SYSTEM\WEBCHECK.DLL
AUHook: C:\WINDOWS\SYSTEM\AUHOOK.DLL
UPnPMonitor: C:\WINDOWS\SYSTEM\UPNPUI.DLL

--------------------------------------------------
End of report, 28,423 bytes
Report generated in 0.335 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only


----------



## eddie5659

Just looking at it, I see this:

*Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

PSD Tools Channel = C:\Program Files\Common Files\PSD Tools\ChannelUp.exe*

This is about it:

http://vil.nai.com/vil/content/v_101007.htm

Though, Derek may know more on this...

We'll wait for his reply on this. Also, awaiting my log from my mate. so will post when its arrived.

eddie


----------



## eddie5659

Okay, here is his:

StartupList report, 15/02/2004, 20:29:45
StartupList version: 1.52
Started from : C:\MY DOCUMENTS\HIJACKTHIS.EXE
Detected: Windows ME (Win9x 4.90.3000)
Detected: Internet Explorer v5.51 SP2 (5.51.4807.2300)
* Using default options
* Including empty and uninteresting sections
* Showing rarely important sections
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\PROGRAM FILES\NET NANNY\NNSVC.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSRTE.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\IBMTOOLS\APTEZBTN\APTEZBP.EXE
C:\PROGRAM FILES\NET NANNY\NNTRAY.EXE
C:\PROGRAM FILES\INKLINE GLOBAL\PC BOOSTER\PCBOOSTER.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\MCAFEE.COM\PERSONAL FIREWALL\MPFTRAY.EXE
C:\PROGRAM FILES\MCAFEE\SPAMKILLER\SPAMKILLER.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHLD.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSESCN.EXE
C:\PROGRAM FILES\MCAFEE.COM\AGENT\MCAGENT.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZONEALARM.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\MCAFEE.COM\PERSONAL FIREWALL\MPFAGENT.EXE
C:\WINDOWS\WUAUCLT.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\OUTLOOK EXPRESS\MSIMN.EXE
C:\MY DOCUMENTS\HIJACKTHIS.EXE

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\WINDOWS\Start Menu\Programs\StartUp]
Event Reminder.lnk = C:\Program Files\Mindscape\PrintMaster\PMREMIND.EXE

Shell folders AltStartup:
*Folder not found*

User shell folders Startup:
*Folder not found*

User shell folders AltStartup:
*Folder not found*

Shell folders Common Startup:
[C:\WINDOWS\All Users\Start Menu\Programs\StartUp]
ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe

Shell folders Common AltStartup:
*Folder not found*

User shell folders Common Startup:
*Folder not found*

User shell folders Alternate Common Startup:
*Folder not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

ScanRegistry = C:\WINDOWS\scanregw.exe /autorun
SystemTray = SysTray.Exe
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
AEZBProc = c:\ibmtools\aptezbtn\aptezbp.exe
NNTray = C:\Program Files\Net Nanny\NNTray.exe /autorun
PC Booster = C:\Program Files\inKline Global\PC Booster\pcbooster.exe
LoadQM = loadqm.exe
MPFExe = C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE
MSKExe = c:\PROGRA~1\MCAFEE\SPAMKI~1\spamkiller.exe
VSOCheckTask = "C:\PROGRA~1\MCAFEE.COM\VSO\MCMNHDLR.EXE" /checktask
VirusScan Online = "C:\PROGRA~1\MCAFEE.COM\VSO\mcvsshld.exe"
MCAgentExe = C:\PROGRA~1\MCAFEE.COM\AGENT\mcagent.exe
MCUpdateExe = C:\PROGRA~1\MCAFEE.COM\AGENT\MCUPDATE.EXE

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
SSDPSRV = C:\WINDOWS\SYSTEM\ssdpsrv.exe
*StateMgr = C:\WINDOWS\System\Restore\StateMgr.exe
TrueVector = C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
McAfeeWebScanX = C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE
VIRUSSCAN\WebScanX.Exe /RUNSERVICES
NNSvc = C:\Program Files\Net Nanny\NNSvc.exe
McVsRte = C:\PROGRA~1\MCAFEE.COM\VSO\mcvsrte.exe /embedding

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

RamBooster = C:\PROGRAM FILES\RAMBOOSTER\RAMBOOSTER.EXE
MsnMsgr = "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

--------------------------------------------------

File association entry for .EXE:
HKEY_CLASSES_ROOT\exefile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .COM:
HKEY_CLASSES_ROOT\comfile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .BAT:
HKEY_CLASSES_ROOT\batfile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .PIF:
HKEY_CLASSES_ROOT\piffile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .SCR:
HKEY_CLASSES_ROOT\scrfile\shell\open\command

(Default) = "%1" /S

--------------------------------------------------

File association entry for .HTA:
HKEY_CLASSES_ROOT\htafile\shell\open\command

(Default) = C:\WINDOWS\SYSTEM\MSHTA.EXE "%1" %*

--------------------------------------------------

Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)

[SetupcPerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection SetupcPerUser 64 C:\WINDOWS\INF\setupc.inf

[AppletsPerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection AppletsPerUser 64 C:\WINDOWS\INF\applets.inf

[PerUser_CVT_Inis]
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_CVT_Inis 64 C:\WINDOWS\INF\applets1.inf

[FontsPerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection FontsPerUser 64 C:\WINDOWS\INF\fonts.inf

[PerUser_HNW_Inis] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_HNW_Inis 64 C:\WINDOWS\INF\ICS.inf

[PerUser_ICW_Inis] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_ICW_Inis 0 C:\WINDOWS\INF\icw97.inf

[{89820200-ECBD-11cf-8B85-00AA005B4395}] *
StubPath = regsvr32.exe /s /n /i:U shell32.dll

[PerUser_moviemaker] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_moviemaker 64 C:\WINDOWS\INF\moviemk.inf

[>PerUser_MSN_Clean] *
StubPath = C:\WINDOWS\msnmgsr1.exe

[{CA0A4247-44BE-11d1-A005-00805F8ABE06}] *
StubPath = RunDLL setupx.dll,InstallHinfSection PowerCfg.user 0 powercfg.inf

[PerUser_Msinfo] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Msinfo 64 C:\WINDOWS\INF\msinfo.inf

[PerUser_Msinfo2] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Msinfo2 64 C:\WINDOWS\INF\msinfo.inf

[MotownMmsysPerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection MotownMmsysPerUser 64 C:\WINDOWS\INF\motown.inf

[MotownAvivideoPerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection MotownAvivideoPerUser 64 C:\WINDOWS\INF\motown.inf

[PerUser_Base] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Base 64 C:\WINDOWS\INF\msmail.inf

[SamplerPerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection SamplerPerUser 64 C:\WINDOWS\INF\sampler.inf

[ShellPerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection ShellPerUser 64 C:\WINDOWS\INF\shell.inf

[Shell2PerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection Shell2PerUser 64 C:\WINDOWS\INF\shell2.inf

[PerUser_winbase_Links] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_winbase_Links 64 C:\WINDOWS\INF\subase.inf

[PerUser_winapps_Links] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_winapps_Links 64 C:\WINDOWS\INF\subase.inf

[PerUser_LinkBar_URLs] *
StubPath = C:\WINDOWS\COMMAND\sulfnbk.exe /L

[TapiPerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection TapiPerUser 64 C:\WINDOWS\INF\tapi.inf

[PerUser_MSWordPad_Inis] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_MSWordPad_Inis 64 C:\WINDOWS\INF\wordpad.inf

[PerUserOldLinks] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUserOldLinks 64 C:\WINDOWS\INF\appletpp.inf

[MmoptRegisterPerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection MmoptRegisterPerUser 64 C:\WINDOWS\INF\mmopt.inf

[PerUser_CDPlayer_Inis] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_CDPlayer_Inis 64 C:\WINDOWS\INF\mmopt.inf

[OlsPerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection OlsPerUser 64 C:\WINDOWS\INF\ols.inf

[OlsMsnPerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection OlsMsnPerUser 64 C:\WINDOWS\INF\ols.inf

[PerUser_PCHealth] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_PCHealth 64 C:\WINDOWS\INF\pchealth.inf

[{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection
C:\WINDOWS\INF\mplayer2.inf,PerUserStub

[{6BF52A52-394A-11d3-B153-00C04F79FAA6}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection
C:\WINDOWS\INF\wmp.inf,PerUserStub

[PerUser_Paint_Inis] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Paint_Inis 64 C:\WINDOWS\INF\applets.inf

[PerUser_Calc_Inis] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Calc_Inis 64 C:\WINDOWS\INF\applets.inf

[PerUser_dxxspace_Links] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_dxxspace_Links 64 C:\WINDOWS\INF\applets1.inf

[PerUser_Enable_Inis] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Enable_Inis 64 C:\WINDOWS\INF\enable.inf

[PerUser_Wingames_Inis] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Wingames_Inis 64 C:\WINDOWS\INF\games.inf

[PerUser_ZoneGame_Inis] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_ZoneGame_Inis 64 C:\WINDOWS\INF\games.inf

[PerUser_PBGame_Inis] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_PBGame_Inis 64 C:\WINDOWS\INF\games.inf

[MotownRecPerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection MotownRecPerUser 64 C:\WINDOWS\INF\motown.inf

[PerUser_Vol] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Vol 64 C:\WINDOWS\INF\motown.inf

[MotownMPlayPerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection MotownMPlayPerUser 64 C:\WINDOWS\INF\motown.inf

[PerUser_RNA_Inis] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_RNA_Inis 64 C:\WINDOWS\INF\rna.inf

[PerUser_Sysmon_Inis] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Sysmon_Inis 64 C:\WINDOWS\INF\appletpp.inf

[PerUser_Sysmeter_Inis] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Sysmeter_Inis 64 C:\WINDOWS\INF\appletpp.inf

[PerUser_netwatch_Inis] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_netwatch_Inis 64 C:\WINDOWS\INF\appletpp.inf

[PerUser_CharMap_Inis] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_CharMap_Inis 64 C:\WINDOWS\INF\appletpp.inf

[PerUser_Onlinelnks_Inis] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Onlinelnks_Inis 64 C:\WINDOWS\INF\appletpp.inf

[PerUser_Dialer_Inis] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Dialer_Inis 64 C:\WINDOWS\INF\appletpp.inf

[PerUser_ClipBrd_Inis] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_ClipBrd_Inis 64 C:\WINDOWS\INF\clip.inf

[MmoptMusicaPerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection MmoptMusicaPerUser 64 C:\WINDOWS\INF\mmopt.inf

[MmoptJunglePerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection MmoptJunglePerUser 64 C:\WINDOWS\INF\mmopt.inf

[MmoptRobotzPerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection MmoptRobotzPerUser 64 C:\WINDOWS\INF\mmopt.inf

[MmoptUtopiaPerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection MmoptUtopiaPerUser 64 C:\WINDOWS\INF\mmopt.inf

[{44BBA842-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.W95

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = "C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:OE /CALLER:IE50 /user
/install

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = "C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:IE50 /user
/install

[OlsAolPerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection OlsAolPerUser 64 C:\WINDOWS\INF\ols.inf

[OlsAttPerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection OlsAttPerUser 64 C:\WINDOWS\INF\ols.inf

[OlsProdigyPerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection OlsProdigyPerUser 64 C:\WINDOWS\INF\ols.inf

[OlsEarthlinkPerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection OlsEarthlinkPerUser 64 C:\WINDOWS\INF\ols.inf

[Shell3PerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection Shell3PerUser 64 C:\WINDOWS\INF\shell3.inf

[Theme_MoreWindows_PerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection Themes_MoreWindows_PerUser 0 C:\WINDOWS\INF\themes.inf

[PerUser_Preptool] *
StubPath = rundll.exe Setupx.dll,InstallHinfSection Install 64
C:\WINDOWS\INF\RUNLAST.INF

[^RNA] *
StubPath = rundll rnasetup.dll,installoptionalcomponent rna

[{44BBA851-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection
C:\WINDOWS\INF\wpie4x86.inf,PerUserStub

[{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}] *
StubPath = C:\WINDOWS\SYSTEM\updcrl.exe -e -u
C:\WINDOWS\SYSTEM\verisignpub1.crl

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = C:\WINDOWS\SYSTEM\ie4uinit.exe

[>{D632D8E0-2EF8-11D3-8EC3-00A024AC5F1C}S03254] *
StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

--------------------------------------------------

Enumerating ICQ Agent Autostart apps:
HKCU\Software\Mirabilis\ICQ\Agent\Apps

*Registry key not found*

--------------------------------------------------

Load/Run keys from C:\WINDOWS\WIN.INI:

load=
run=

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\SYSTEM\UNDERW~2.SCR
drivers=mmsystem.dll power.drv

--------------------------------------------------

Checking for EXPLORER.EXE instances:

C:\WINDOWS\Explorer.exe: PRESENT!

C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present
C:\WINDOWS\Fonts\Explorer.exe: not present

--------------------------------------------------

C:\WINDOWS\WININIT.INI listing:

*File not found*

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:

*File not found*

--------------------------------------------------

C:\AUTOEXEC.BAT listing:

SET windir=C:\WINDOWS
SET winbootdir=C:\WINDOWS
SET COMSPEC=C:\WINDOWS\COMMAND.COM
SET PATH=C:\WINDOWS;C:\WINDOWS\COMMAND
SET PROMPT=$p$g
SET TEMP=C:\WINDOWS\TEMP
SET TMP=C:\WINDOWS\TEMP

--------------------------------------------------

C:\CONFIG.SYS listing:

*File is empty*

--------------------------------------------------

C:\WINDOWS\WINSTART.BAT listing:

C:\WINDOWS\tmpcpyis.bat

--------------------------------------------------

C:\WINDOWS\DOSSTART.BAT listing:

echo off
REM Notes:
REM DOSSTART.BAT is run whenenver you choose "Restart the computer
REM in MS-DOS mode" from the Shutdown menu in Windows. It allows
REM you to load programs that you might not want loaded in Windows,
REM (because they have functional equivalents) but that you do
REM want loaded under MS-DOS. The two primary candidates for
REM this are MSCDEX and a real mode driver for the mouse you ship
REM with your system. Commands that you want present in both Windows
REM and MS-DOS should be placed in the Autoexec.bat in the
REM \Image directory of your reference server. Please note that for
REM MSCDEX you will need to load the corresponding real-mode CD
REM driver in Config.sys. This driver won't be used by Windows 98
REM but will be available prior to and after Windows 98 exits.
REM
REM This file is also helpful if you want to F8 boot into MS-DOS 7.0
REM before Windows loads and access the CD-ROM. All you have to do
REM is press F8 and then run DOSSTART to load MSCDEX and your real
REM mode mouse driver (no need to remember the command line parameters
REM for these two files.
REM
REM - You MUST explicitly specify the CD ROM Drive Letter for MSCDEX.
REM - The string following the /D: statement must explicitly match
REM the string in CONFIG.SYS following your CD-ROM device driver.
REM MSCDEX.EXE /D:OEMCD001 /l:d
REM MOUSE.EXE

--------------------------------------------------

Checking for superhidden extensions:

.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden

--------------------------------------------------

Verifying REGEDIT.EXE integrity:

- Regedit.exe found in C:\WINDOWS
- .reg open command is normal (regedit.exe %1)
- Company name OK: 'Microsoft Corporation'
- Original filename OK: 'REGEDIT.EXE'
- File description: 'Registry Editor'

Registry check passed

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - C:\PROGRAM FILES\ADOBE\ACROBAT
5.0\READER\ACTIVEX\ACROIEHELPER.OCX - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
CCHelper - C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER\CCHELPER.DLL -
{0CF0B8EE-6596-11D5-A98E-0003470BB48E}

--------------------------------------------------

Enumerating Task Scheduler jobs:

McAfee.com Update Check 01152004195518.job

--------------------------------------------------

Enumerating Download Program Files:

[Microsoft XML Parser for Java]
CODEBASE = file://C:\WINDOWS\Java\classes\xmldso.cab
OSD = C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd

[DirectAnimation Java Classes]
CODEBASE = file://C:\WINDOWS\SYSTEM\dajava.cab
OSD = C:\WINDOWS\Downloaded Program Files\DirectAnimation Java Classes.osd

[McAfee.com Operating System Class]
InProcServer32 = C:\WINDOWS\SYSTEM\MCINSCTL.DLL
CODEBASE =
http://bin.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,76/mcinsctl.cab

[{AD7FAFB0-16D6-40C3-AF27-585D6E6453FD}]
CODEBASE = http://dload.ipbill.com/del/loader.cab

[TIBSLoader Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\TL4000.DLL
CODEBASE = http://www.directplugin.com/tl4000.dll

[MyWebOperator Class]
InProcServer32 = C:\WINDOWS\DIALERAUTOLOADER.DLL
CODEBASE = http://198.143.27.16/xxxaccess/Loader.cab

--------------------------------------------------

Enumerating Winsock LSP files:

NameSpace #1: C:\WINDOWS\SYSTEM\rnr20.dll
Protocol #1: C:\WINDOWS\SYSTEM\msafd.dll
Protocol #2: C:\WINDOWS\SYSTEM\msafd.dll
Protocol #3: C:\WINDOWS\SYSTEM\msafd.dll
Protocol #4: C:\WINDOWS\SYSTEM\rsvpsp.dll
Protocol #5: C:\WINDOWS\SYSTEM\rsvpsp.dll

--------------------------------------------------

Enumerating Win9x VxD services:

VNETSUP: vnetsup.vxd
VPOWERD: *VPOWERD
NDIS: ndis.vxd
JAVASUP: JAVASUP.VXD
CONFIGMG: *CONFIGMG
NTKern: *NTKERN
VWIN32: *VWIN32
VFBACKUP: *VFBACKUP
VCOMM: *VCOMM
COMBUFF: *COMBUFF
IFSMGR: *IFSMGR
IOS: *IOS
MTRR: *MTRR
SPOOLER: *SPOOLER
UDF: *UDF
VFAT: *VFAT
VCACHE: *VCACHE
VCOND: *VCOND
VCDFSD: *VCDFSD
VXDLDR: *VXDLDR
VDEF: *VDEF
VPICD: *VPICD
VTD: *VTD
REBOOT: *REBOOT
VDMAD: *VDMAD
VSD: *VSD
V86MMGR: *V86MMGR
PAGESWAP: *PAGESWAP
DOSMGR: *DOSMGR
VMPOLL: *VMPOLL
SHELL: *SHELL
PARITY: *PARITY
BIOSXLAT: *BIOSXLAT
VMCPD: *VMCPD
VTDAPI: *VTDAPI
PERF: *PERF
VREDIR: vredir.vxd
DFS: dfs.vxd
VSDATA95: vsdata95.vxd

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

WebCheck: C:\WINDOWS\SYSTEM\WEBCHECK.DLL
UPnPMonitor: C:\WINDOWS\SYSTEM\UPNPUI.DLL
AUHook: C:\WINDOWS\SYSTEM\AUHOOK.DLL

--------------------------------------------------
End of report, 25,508 bytes
Report generated in 0.616 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of
platform
/history - to list version history only


----------



## eddie5659

And this is what I have seen so far....

Brain, this is yours:

C:\PROGRAM FILES\SYMANTEC_CLIENT_SECURITY\SYMANTEC ANTIVIRUS\DEFWATCH.EXE

Detects out-of-date virus definitions for Norton Anti-Virus Corporate Edition and runs the Defwatch Wizard. Only required if you don't update the virus definitions manually on a regular basis. Remove

*C:\PROGRAM FILES\COMMON FILES\PSD TOOLS\CHANNELUP.EXE

mentioned in Reply (last)*

C:\WINDOWS\WT\UPDATER\WCMDMGR.EXE

It will periodically contact Wild Tangent servers to see if an update is available for your system and allows us to make the product exceptionally reliable. You can control its behavior, or disable it completely, inside your Windows Control Panel. Note that Wild Tanget's privacy policy states they also collect and share individuals information. Remove

TaskMonitor = c:\windows\taskmon.exe

The Task Monitor checks the disk-access patterns of programs when they are started and stores this information in log files in the Applog folder. Task Monitor also records the number of times you use a program. The Disk Defragmenter tool uses this information to optimize your hard disk so that programs that you use frequently are loaded faster. Not required - but can be useful. Note: for Norton Anti-Virus 2002 users, loading TaskMonitor will typically solve many, if not most, of those annoying IE scripting errors (per Symantec's Knowledgebase). up to you

StillImageMonitor = C:\WINDOWS\SYSTEM\STIMON.EXE

Stimon.exe enables a USB still-image device (such as a scanner) to initiate data transfer to a program. For example, if your scanning device has a scan button, it may start a program and begin scanning when you press it. Create a shortcut and start it manually when needed if your scanner otherwise fails to scan. May be required for your USB scanner to work - including all HP scanners. up to you

---------

Posting in parts as it will make it easier to see


----------



## eddie5659

Now, the Registry I'm not that 'up' on, so will grab some others to take a look 

Yours:

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

[OptionalComponents]
*No values found*

His:

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
*No subkeys found*

Should they be saying the same thing?

----------


----------



## eddie5659

My mate has these extra, compared to yours:

[PerUser_CVT_Inis]
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_CVT_Inis 64 C:\WINDOWS\INF\applets1.inf

[PerUser_HNW_Inis] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_HNW_Inis 64 C:\WINDOWS\INF\ICS.inf

[PerUser_moviemaker] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_moviemaker 64 C:\WINDOWS\INF\moviemk.inf

[SamplerPerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection SamplerPerUser 64 C:\WINDOWS\INF\sampler.inf

[PerUser_MSWordPad_Inis] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_MSWordPad_Inis 64 C:\WINDOWS\INF\wordpad.inf

[{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection
C:\WINDOWS\INF\mplayer2.inf,PerUserStub

[{6BF52A52-394A-11d3-B153-00C04F79FAA6}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection
C:\WINDOWS\INF\wmp.inf,PerUserStub

[MotownMPlayPerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection MotownMPlayPerUser 64 C:\WINDOWS\INF\motown.inf

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = "C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:OE /CALLER:IE50 /user
/install

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = "C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:IE50 /user
/install

[PerUser_Preptool] *
StubPath = rundll.exe Setupx.dll,InstallHinfSection Install 64
C:\WINDOWS\INF\RUNLAST.INF

[^RNA] *
StubPath = rundll rnasetup.dll,installoptionalcomponent rna

[{44BBA851-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection
C:\WINDOWS\INF\wpie4x86.inf,PerUserStub

[>{D632D8E0-2EF8-11D3-8EC3-00A024AC5F1C}S03254] *
StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP


----------



## eddie5659

And you have these extra:

[>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] *
StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

[MotownMPlayPerUser] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection MotownMPlayPerUser 64 c:\windows\INF\motown.inf

[{73fa19d0-2d75-11d2-995d-00c04f98bbc9}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection c:\windows\INF\webfdr16.inf,PerUserStub.Install,1

[PerUser_MSBackup_Inis] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_MSBackup_Inis 64 c:\windows\INF\applets1.inf

[PerUser_CVT_Inis]
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_CVT_Inis 64 c:\windows\INF\applets1.inf

[PerUser_CDPlayer_Inis] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_CDPlayer_Inis 64 c:\windows\INF\mmopt.inf

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = rundll32.exe advpack.dll,UserInstStubWrapper {44BBA840-CC51-11CF-AAFA-00AA00B6015C}

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = rundll32.exe advpack.dll,UserInstStubWrapper {7790769C-0471-11d2-AF11-00C04FA35D02}

[Theme_Windows_PerUser] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection Themes_Windows_PerUser 0 c:\windows\INF\themes.inf

[{44BBA851-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection c:\windows\INF\wpie5x86.inf,PerUserStub

[>IEPerUser] *
StubPath = RUNDLL32.EXE IEDKCS32.DLL,BrandIE4 SIGNUP

[Chl99] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\chl99.inf,InstallUser

[PerUser_HNW_Inis] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_HNW_Inis 64 c:\windows\INF\ICS.inf

[PerUser_moviemaker] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_moviemaker 64 c:\windows\INF\moviemk.inf

[SamplerPerUser] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection SamplerPerUser 64 c:\windows\INF\sampler.inf

[PerUser_PCHealth] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_PCHealth 64 c:\windows\INF\pchealth.inf

[{6BF52A52-394A-11d3-B153-00C04F79FAA6}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub

[PerUser_ZoneGame_Inis] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_ZoneGame_Inis 64 c:\windows\INF\games.inf

[PerUser_PBGame_Inis] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_PBGame_Inis 64 c:\windows\INF\games.inf

[{5945c046-1e7d-11d1-bc44-00c04fd912be}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection c:\windows\INF\msmsgs.inf,BLC.Install.PerUser

[PerUser_DCC_Inis]
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_DCC_Inis_remove 64 c:\windows\INF\rna.inf

[OlsEarthlinkPerUser] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection OlsEarthlinkPerUser 64 c:\windows\INF\ols.inf

[{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}] *
StubPath = C:\WINDOWS\SYSTEM\updcrl.exe -e -u C:\WINDOWS\SYSTEM\verisignpub1.crl

[PerUser_ICS_Inis] *
StubPath = rundll.exe c:\windows\SYSTEM\setupx.dll,InstallHinfSection PerUser_ICS_Inis 64 c:\windows\INF\ics.inf


----------



## eddie5659

Mate has this:

C:\WINDOWS\WININIT.INI listing:

*File not found*

Brian:

C:\WINDOWS\WININIT.INI listing:
(Created 14/2/2004, 10:25:30)

[Rename]
NUL=c:\WINDOWS\TEMP\A~NSISU_.EXE

-------

mate:

C:\WINDOWS\WININIT.BAK listing:

*File not found*

Brian:

C:\WINDOWS\WININIT.BAK listing:
(Created 12/2/2004, 21:47:44)

[Rename]
NUL=c:\program files\earthlink 5.0\[email protected]\cookies\[email protected][2].txt
NUL=c:\program files\earthlink 5.0\[email protected]\cookies\[email protected][1].txt
NUL=c:\program files\earthlink 5.0\[email protected]\cookies\[email protected][1].txt
NUL=c:\program files\earthlink 5.0\[email protected]\cookies\[email protected][2].txt
NUL=c:\program files\earthlink 5.0\[email protected]\cookies\[email protected][2].txt
NUL=c:\program files\earthlink 5.0\[email protected]\cookies\[email protected][2].txt
NUL=c:\program files\earthlink 5.0\[email protected]\cookies\[email protected][1].txt
NUL=c:\program files\earthlink 5.0\[email protected]\cookies\[email protected][1].txt
NUL=c:\program files\earthlink 5.0\[email protected]\cookies\[email protected][1].txt

--------

Mate:

C:\AUTOEXEC.BAT listing:

SET windir=C:\WINDOWS
SET winbootdir=C:\WINDOWS
SET COMSPEC=C:\WINDOWS\COMMAND.COM
SET PATH=C:\WINDOWS;C:\WINDOWS\COMMAND
SET PROMPT=$p$g
SET TEMP=C:\WINDOWS\TEMP
SET TMP=C:\WINDOWS\TEMP

Brian:

C:\AUTOEXEC.BAT listing:

SET PATH=C:\WINDOWS;c:\windows;c:\windows\COMMAND;"C:\Program Files\Common Files\Roxio Shared\DLLShared"
SET BLASTER=A220 I7 D1 H5 P330 T6
SET CTSYN=C:\WINDOWS
C:\PROGRA~1\CREATIVE\SBLIVE\DOSDRV\SBEINIT.COM
SET windir=C:\WINDOWS
SET winbootdir=C:\WINDOWS
SET COMSPEC=C:\WINDOWS\COMMAND.COM
SET PROMPT=$p$g
SET TEMP=C:\windows\TEMP
SET TMP=c:\windows\TEMP
SET PS5ROOT=c:\Program Files\Roxio\Easy CD Creator 6\PhotoSuite\


----------



## eddie5659

Brian:

C:\WINDOWS\DOSSTART.BAT listing:

C:\PROGRA~1\CREATIVE\SBLIVE\DOSDRV\SBEINIT.COM
echo off


mate:

C:\WINDOWS\DOSSTART.BAT listing:

echo off


-----

Brian:

Enumerating Browser Helper Objects:

(no name) - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_6_0.DLL - {02478D38-C3F9-4efb-9B51-7695ECA05670}
(no name) - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}


mate:

Enumerating Browser Helper Objects:

(no name) - C:\PROGRAM FILES\ADOBE\ACROBAT
5.0\READER\ACTIVEX\ACROIEHELPER.OCX - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
CCHelper - C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER\CCHELPER.DLL -
{0CF0B8EE-6596-11D5-A98E-0003470BB48E}


Brian:


Enumerating Task Scheduler jobs:

Tune-up Application Start.job
PCHealth Scheduler for Data Collection.job
Symantec NetDetect.job
Run Norton System Check.job

Mate:

Enumerating Task Scheduler jobs:

McAfee.com Update Check 01152004195518.job


----------



## eddie5659

Mates extra:

Enumerating Download Program Files:

[{AD7FAFB0-16D6-40C3-AF27-585D6E6453FD}]
CODEBASE = http://dload.ipbill.com/del/loader.cab

[TIBSLoader Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\TL4000.DLL
CODEBASE = http://www.directplugin.com/tl4000.dll

[MyWebOperator Class]
InProcServer32 = C:\WINDOWS\DIALERAUTOLOADER.DLL
CODEBASE = http://198.143.27.16/xxxaccess/Loader.cab

Brian's extra:

[Internet Explorer Classes for Java]
CODEBASE = file://c:\windows\SYSTEM\iejava.cab
OSD = C:\WINDOWS\Downloaded Program Files\Internet Explorer Classes for Java.osd

[YahooYMailTo Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\YMMAPI.DLL
CODEBASE = http://us.dl1.yimg.com/download.yah...ymmapi_0727.dll

[Update Class]
InProcServer32 = C:\WINDOWS\SYSTEM\IUCTL.DLL
CODEBASE = http://v4.windowsupdate.microsoft.c...7571.6557060185

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX
CODEBASE = http://download.macromedia.com/pub/...ash/swflash.cab

[{00000055-0000-0010-8000-00AA00389B71}]
CODEBASE = http://codecs.microsoft.com/codecs/i386/fhgax.CAB

[HouseCall Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\XSCAN53.OCX
CODEBASE = http://a840.g.akamai.net/7/840/537/...all/xscan53.cab

[{E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD}]
CODEBASE = http://www.smgradio.com/core/player/abasetup.cab

[DmiReader Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\SYSPROFLCD.DLL
CODEBASE = http://support.dell.com/us/en/syste.../SysProfLCD.CAB

[YInstStarter Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\YINSTHELPER.DLL
CODEBASE = http://download.yahoo.com/dl/installs/yinstc.cab

[Ofoto Upload Manager Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\AXOFUPLD.DLL
CODEBASE = http://www.ofoto.com/downloads/BUM/..._1/axofupld.cab

[InstallHelper Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\THEREINSTALLHELPER.DLL
CODEBASE = http://survey.prod.there.com/qualsu...stallHelper.cab

[iPIX ActiveX Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\IPIXX.OCX
CODEBASE = http://www.ipix.com/viewers/ipixx.cab

[ShellInstaller Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\SHELLI~1.OCX
CODEBASE = http://download.buddylinks.net/ShellInstallerRaptor.cab

------------

Mate:

Enumerating Winsock LSP files:

NameSpace #1: C:\WINDOWS\SYSTEM\rnr20.dll
Protocol #1: C:\WINDOWS\SYSTEM\msafd.dll
Protocol #2: C:\WINDOWS\SYSTEM\msafd.dll
Protocol #3: C:\WINDOWS\SYSTEM\msafd.dll
Protocol #4: C:\WINDOWS\SYSTEM\rsvpsp.dll
Protocol #5: C:\WINDOWS\SYSTEM\rsvpsp.dll

Brian:

Enumerating Winsock LSP files:

NameSpace #1: c:\windows\SYSTEM\rnr20.dll
Protocol #1: c:\windows\SYSTEM\mswsosp.dll
Protocol #2: c:\windows\SYSTEM\msafd.dll
Protocol #3: c:\windows\SYSTEM\msafd.dll
Protocol #4: c:\windows\SYSTEM\msafd.dll
Protocol #5: c:\windows\SYSTEM\rsvpsp.dll
Protocol #6: c:\windows\SYSTEM\rsvpsp.dll

-------

Enumerating Win9x VxD services:

mate:

VSDATA95: vsdata95.vxd

Brian:

Flash9x: flash9x.vxd
NDISWAN: ndiswan.vxd

-------------

Phew, that took a lot of time going thru that lot. Now, to see if we can make sense of it all


----------



## eddie5659

Okay, got some other things to try, in the meantime. Just do this to start with.

Boot to safemode, and see if it happens there. Can't believe we overlooked that one

If it still happens, lets go to the BIOS, and disable power management, to see if that's it:

Bios setup, when computer is starting, DEL, F 1, F 2, ESC, Compaqs F 10......depends on the bios. Should be power management settings there too that can be disabled.

Don't change anything else.

eddie


----------



## shoeby2

Eddie, 

I know I'll sound stupid, but how do you boot to safemode?

Brian


----------



## ~Candy~

I see Eddie is offline, he has asked me for opinions and I recommended trying that.

When the computer is restarting, tap the F 8 key, you should get a menu from which you can choose safe mode.


----------



## shoeby2

AcaCandy, 

Thanks for the help. I rebooted into Safe Mode and did not receive the error messages I usually receive. So I then went into BIOS but no where could I find power management. Did I overlook something?

Thanks again, 
Brian


----------



## ~Candy~

Ok, let's try this, start, run, msconfig, enter, startup tab. Uncheck autoexec.bat and config.sys on the main tab. I'm not that familiar with ME, but I think something is there where you can disable those two items.


----------



## shoeby2

I don't see autoexec.bat or config.sys on the startup, under msconfig?


----------



## ~Candy~

Selective startup? I'm sorry, I just don't do ME at all, have I MEntioned I hate ME 

Look around, you'll have to help ME here.


----------



## shoeby2

I've grown to hate ME as well. I'm not sure how to get to selective startup, sorry.


----------



## ~Candy~

Somewhere on that msconfig tab, I believe, you have different options. I don't have a ME computer here, so all I can do is google search as well as you can too. I believe there should be other tabs other than just the main startup tab, but I can't be sure.


----------



## shoeby2

The tabs I have under msconfig are General, System.ini., Win.ini., Static VxDs, Startup, Environment and International.


----------



## ~Candy~

On the general tab, or startup tab. Anything to uncheck those two files, or perhaps 'selective startup.' ????

Where are all the ME people


----------



## shoeby2

On the General Tab, there is 'Selective Startup', with these choices:

Process System.ini file
Process Win.ini file
Load static VxDs
Load startup group items
Load environment variables


----------



## ~Candy~

http://service1.symantec.com/SUPPOR...02 for Windows 2000/NT/Me/98/XP&osv=&osv_lvl=

 Finally googled.


----------



## shoeby2

Should I follow the instructions and do a clean boot?


----------



## ~Candy~

Yes please.


----------



## shoeby2

Is this going to wipe things off my machine that I've put on over the years?


----------



## ~Candy~

Heavens no, all we are doing is trying to isolate the startup problem.


----------



## shoeby2

I'm sorry - I just get very nervous since I'm not all that comfortable with the "backgrounds" of computing. Going to do it now.

Brian


----------



## ~Candy~

No problem, you can't believe everything you read on the internet


----------



## shoeby2

Ok, ran the clean boot and when it went to VGA mode the 3 error messages did not show up. Restarted with normal statup and the 3 error boxes came back, along with a bunch of stuff in my startup tray?


----------



## ~Candy~

3 error boxes? I thought we had one? Maybe I didn't read back thru everything......

What items are in the system tray that weren't there before? Maybe items you had turned off before?


----------



## shoeby2

It's really two error messages. One is an Error Starting Program box that says "The POWRPROF.DLL file cannot start. Check the file to determine the problem." 

The 2nd message comes up twice and it's a RUNDLL box saying, "Error loading powrproff.dll A dynamic link library (DLL) initialization routine failed."

In my startup tray, yes it's a lot of stuff I had removed before.


----------



## shoeby2

Actually, now when I go back into msconfig under startup, everything single thing there is checked.


----------



## ~Candy~

You can repost a listing, and we can go thru the unchecking again.

Start, run, msinfo32 and enter, go to software, startups, edit, select all, edit, copy and come back and paste.


----------



## shoeby2

Thanks Aca, 

I've unchecked a lot of the items, but here's my list:

*StateMgr	c:\windows\system\restore\statemgr.exe	All Users	HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
BJCFD	c:\program files\broadjump\client foundation\cfd.exe	All Users	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
CVPND	"c:\program files\cisco\vpnclient\cvpnd.exe" start	All Users	HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
defwatch	c:\progra~1\symant~1\symant~1\defwatch.exe	All Users	HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
LoadPowerProfile	rundll32.exe powrprof.dll,loadcurrentpwrscheme	All Users	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
LoadPowerProfile	rundll32.exe powrprof.dll,loadcurrentpwrscheme	All Users	HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
LoadQM	loadqm.exe	All Users	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
NvCplDaemon	rundll32.exe c:\windows\system\nvcpl.dll,nvstartup	All Users	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
nwiz	nwiz.exe /install	All Users	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
rtvscn95	c:\progra~1\symant~1\symant~1\rtvscn95.exe	All Users	HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
ScanRegistry	c:\windows\scanregw.exe /autorun	All Users	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SchedulingAgent	mstask.exe	All Users	HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
SSDPSRV	c:\windows\system\ssdpsrv.exe	All Users	HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
StillImageMonitor	c:\windows\system\stimon.exe	All Users	HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
SystemTray	systray.exe	All Users	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
TaskMonitor	c:\windows\taskmon.exe	All Users	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
UpdReg	c:\windows\updreg.exe	All Users	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
vptray	c:\progra~1\symant~1\symant~1\vptray.exe	All Users	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


----------



## ~Candy~

Without reading back thru, I'm assuming you guys tried replacing that file by extracting a new copy from the windows cab files?

Also out of curiosity, your virus program data files is current correct? And you recently scanned for viruses?


----------



## shoeby2

Yes, we tried to do an extract/replace.

As far as my virus protection, I have a corporate edition so it should be up to date. I will run a virus scan now though.


----------



## ~Candy~

Do a manual check for updates first.


----------



## shoeby2

It was last updated on the 18th. Just ran and found nothing.


----------



## ~Candy~

Ok, this is getting personal now 

Did Eddie have a look at what is loading via system.ini and win.ini?

Start, run, sysedit and ok........does that work on ME?


----------



## eddie5659

Hiya Candy

We even tried replacing the file from one my mate gave me, same version.

This has turned out to be a 'one to be Solved' question 

From his startup list, he has this:

*Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

PSD Tools Channel = C:\Program Files\Common Files\PSD Tools\ChannelUp.exe

http://vil.nai.com/vil/content/v_101007.htm*

Thing is, its not in the HT log.

eddie


----------



## ~Candy~

I don't see that on the startup list


----------



## eddie5659

It's in 2 places:

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\SYMANTEC_CLIENT_SECURITY\SYMANTEC ANTIVIRUS\RTVSCN95.EXE
C:\PROGRAM FILES\SYMANTEC_CLIENT_SECURITY\SYMANTEC ANTIVIRUS\DEFWATCH.EXE
C:\PROGRAM FILES\CISCO\VPNCLIENT\CVPND.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\SYMANTEC_CLIENT_SECURITY\SYMANTEC ANTIVIRUS\VPTRAY.EXE
*C:\PROGRAM FILES\COMMON FILES\PSD TOOLS\CHANNELUP.EXE*
C:\WINDOWS\WT\UPDATER\WCMDMGR.EXE
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE

and if you scroll down after that, its the sixth listing for Autorun entries from Registry entries

eddie


----------



## eddie5659

Ah, not the last startup list, thats my mates. Its the first one, after the HT log on page 8:

http://forums.techguy.org/showthread.php?postid=1441012


----------



## ~Candy~

But his new startup list on page 10 doesn't show it........not sure what your page views are set at


----------



## eddie5659

On page 11 now 

Hmm, the list I was looking at is his entire log, that HT can do. It has entries for autorun, file associations, etc.

He may have removed it by now, anyway 

eddie


----------



## ~Candy~

I'm almost out of other ideas barring the win.ini or system.ini files. Wonder if format c: is out of the question


----------



## eddie5659

Its a dilly of a pickle of a question. I've been all over the place.

Gonna post a thread in the newsgroups tonight, so lets hope someone at Microsoft has some ideas.....yeah, right 

eddie


----------



## eddie5659

Okay, this is the newsgroup posting:
http://communities.microsoft.com/Ne...4ce701c3f986%245c57aed0%[email protected]%3E

But will ost the Google one, when its loaded

eddie


----------



## ~Candy~

You forgot to mention that the error messages don't appear when starting via safe mode


----------



## kilowatt1

Since the problem seems to have happened after Norton played around with the registry, I would try Scanreg /restore if it hasn't been too long. Another thought is that Norton removed a dll for a program or device that was somehow connected to or needed by the pwrprof service dll. You might try disabling everything via msconfig/startup except the essentials (systray, scanreg) then restart and see if the error message disappears. If it does, then enable the startup programs one at a time to see which one is causing the problem. Running a scanreg /fix might be another option.

Just some thoughts.

Kilowatt


----------



## eddie5659

Hiya Kilowatt

He tried a restore a while back, but that didn't solve the problem. 

eddie


----------



## eddie5659

Here's the google thread:

http://groups.google.com/[email protected]&rnum=1


----------



## ~Candy~

I'm still thinking system.ini (especially) or win.ini


----------



## violatio

Hiya,

just wondeirng if the problem has been solved ? Coz i'm currently facing the same problem. Using a Toshiba Laptop with Windows XP. Thing is, the 'powrprof.dll could not load" dialog box has a heading of THOTKEY.EXE.

i wonder if that might be the problem...


----------



## bustab

violatio said:


> Hiya,
> 
> just wondeirng if the problem has been solved ? Coz i'm currently facing the same problem. Using a Toshiba Laptop with Windows XP. Thing is, the 'powrprof.dll could not load" dialog box has a heading of THOTKEY.EXE.
> 
> i wonder if that might be the problem...


I'm getting exactly the same thing also on a Toshiba Laptop running XP. I'm also unable to connect properly to the net. It connects but when I try to access a web page or download a virus update or other such file I get "page not found" or it can't connect. The syptoms point towards a virus but nothing got picked up when I scanned.

Are these symptoms familiar to you?


----------



## shoeby2

Hi guys, this really never got resolved. I just now live with it. When the messages come up I click ok and move on with my work.


----------



## bustab

There's no choice of just living with my problem it's far too disruptive. It seems they are different problems relating to the same file. As I say, it looks to me like my and probably violatio's problem are caused by a virus. I've done a full scan from DOS as well now but still no joy. I'm doing another scan tomorrow with a couple of totally up to the minute AV's, and if there's still no result I'm going to format.


----------



## eddie5659

AcaCandy said:


> I'm still thinking system.ini (especially) or win.ini


shoeby2, can you post these?

Just go to Start | Run and type SYSEDIT, and press OK.

Then, copy/paste each here

eddie


----------



## bustab

*Violatio*- it's sasser.A, fix it with the microsoft removal tool.


----------



## shoeby2

Hello, I know it's been a long time. I just checked back because for some reason I don't get emails anymore when someone posts. Anyway, here is the win.ini.

Here's the win.ini

[windows]
load=
NullPort=None
UninstallPath=C:\
ScreenSaveActive=1
ScreenSaveTimeOut=300
norun=hpfsched
Run=hpfsched
device=HP DeskJet 840C Series,hpf9xdr0,LPT1:

[Desktop]
Wallpaper=C:\WINDOWS\APPLIC~1\MICROS~1\INTERN~1\INTERN~1.BMP
TileWallpaper=0
WallpaperStyle=2
Pattern=(None)

[intl]
iCountry=1
ICurrDigits=2
iCurrency=0
iDate=0
iDigits=2
iLZero=1
iMeasure=1
iNegCurr=0
iTime=0
iTLZero=0
s1159=AM
s2359=PM
sCountry=United States
sCurrency=$
sDate=/
sDecimal=.
sLanguage=enu
sList=,
sLongDate=dddd, MMMM dd, yyyy
sShortDate=M/d/yyyy
sThousand=,
sTime=:

[fonts]

[FontSubstitutes]
Helv=MS Sans Serif
Tms Rmn=MS Serif
Times=Times New Roman
Helvetica=Arial
MS Shell Dlg=MS Sans Serif

[Compatibility]
_3DPC=0x00400000
_BNOTES=0x224000
_LNOTES=0x00100000
ACAD=0x8000
ACT!=0x400004
ACROBAT=0x04000000
AD=0x10000000
ADW30=0x10000000
ALARMMGR=0x0040000
ALDSETUP=0x00400000
AMIPRINT=0x04000000
AMIPRO=0x04000010
APORIA=0x0100
APPROACH=0x0004
BALER=0x08000000
BMAPP=0x0004
CASMONEY=0x00200000
CAVOIDE=0x00200000
CCMAIL=0x00200000
CCMCWFY=0x80
CHARISMA=0x2000
CONFIG=0x00400000
CORELDRW=0x48000
CORELPNT=0x08000000
COSTAR=0x0004
CP=0x0040
CROSSTIE=0x00000400
DARCH=0x80
DESIGNER=0x00002000
DIRECTOR=0x00800000
DPLANNER=0x00200000
DRAW=0x2000
DS40=0x8000
DTWIN20=0x00000400
EAP=0x0004
ED=0x00010000
EXCEL=0x1000
EXPASTRO=0x04000000
EXTYPWND=0x00200000
FAXVIEW=0x04000000
FAXWORKS=0x00000400
FH4=0x00E08000
FLW2=0x8000
FMPRO=0x00200000
FREEHAND=0x8000
FULLTEXT=0x20000000
GIFTMAKE=0x20000000
GUIDE=0x1000
HDW=0x04800000
HGW=0x8000
HGW2EXE=0x8000
HGW3EXE=0x8000
HJDRAW=0x00400000
IDAPICFG=0x00400000
IDRAW=0x04008000
ILLUSTRATOR=0x8000
IMPROV2=0x00000000
INFOCENT=0x04000000
INSIGHT=0x00000400
INSTAL1=0x00400000
INSTALL=0x00400000
INTERMIS=0x10000000
IS20INST=0x00000000
IVIHEALT=0x00400000
JEOPARDY=0x00200000
JW=0x00000000
KALOAD2=0x00400000
KEYCAD=0x8000
LE_ADMIN=0x00400000
LUI=0x20000000
MAILSPL=0x10000000
MAKER=0x00200000
MAPS1=0x04008022
MATH=0x00000001
MAVIS=0x00200000
MCOURIER=0x0800
MFWIN20=0x02000000
MILESV3=0x1000
MILESV40=0x4
MOZART=0x40000000
MSARTIST=0x00100000
MSBHUMAN=0x4
MSREMIND=0x10000000
MVIEWER2=0x40200000
MYINV=0x00200000
MYST=0x08000000
NAFTA1=0x4008022
NBAMW4V4=0x04000000
NETSET2=0x0100
NOTES=0x200000
NOTSHELL=0x0001
OPERATOR=0x02000000
OUTPOST=0x00000000
OWLAPP=0x00400000
PACKRAT=0x0800
PAINTER=0x00000000
PAWC8DC3=0x00400000
PAWIN=0x4
PEACHW=0x04800004
PIXIE=0x0040
PLANIT=0x0004
PLANNER=0x2000
PLUS=0x1000
PM4=0xA000
PM5APP=0x8000
PP4=0x00000000
PR2=0x2000
PRINTHLP=0x0004
QAPLUSW=0x0004
QLIIFAX=0x00400000
QUAKE=0x80
QW=0x08000000
RELAY=0x20000000
REM=0x8022
RR2CD=0x00200000
RX=0x00000400
RXL=0x00000400
SETUP=0x00000000
SIDEKICK=0x0004
SLEEPER=0x10000000
SOL=0x00400000
SPCB=0x04008000
SPORTJEP=0x00200000
SPWIN20=0x00400000
ST2=0x4008022
STRAUSS=0x40000000
STRAV=0x40000000
SCHUBERT=0x40000000
SSBWIN=0x00200000
SWCWIN=0x00800004
TCVWIN=0x00200000
TCW=0x00400000
TCWIN=0x0004
TERRAIN=0x00400000
TISETUP=0x00200000
TL6=0x08000000
TME=0x0100
TMSWIN=0x20000000
TMTWIN=0x00200000
TMTWINCD=0x00200000
TOUCHUP=0x00400000
TURBOTAX=0x00080000
VB=0x0200
VEWINFIL=0x00400000
VISIO=0x00000004
VISIOHM=0x00000004
VISION=0x0040
W4GL=0x4000
W4GLR=0x4000
WGW=0x00440000
WIN2WRS=0x1210
WINCIM=0x4
WINLINK=0x20000000
WINPHONE=0x0004
WINSIM=0x2000
WINTACH=0x00200000
WORDSCAN=0x02200000
WPWINFIL=0x00000006
WPWIN60=0x00000400
WPWIN61=0x02000400
WSETUP=0x00200000
XPRESS=0x00000008
ZETA01=0x00400000
ZIFFBOOK=0x00200000
HPOLNK08=0x00400000
NDITEST=0x00400000
UNWISE=0x00400000
NOTIFIER=0x400000

[Compatibility32]
CLWORKS=0x00A00000
MCAD=0x00600000
PHOTOSHP=0x00208000
PODW=0x00200000
SPSSWIN=0x00200000
TYPSTRY2=0x00200000
V32VM20=0x02000000
VISIO=0x00000000
VISIOHM=0x00000000
WINPHONE=0x00000004
WRDART32=0x00400000
SHELL=0x80000000
USTATION=0x80000000

[Compatibility95]
CHAOS OV=0x80000000
CONF=0x00000002
MSDEV=0x00000002
IMAGE32=0x80000000
INST32=0x80000000
_INS0432=0x00080000
_INS5176=0x00080000
_INS576=0x00080000
_INS5576=0x00080000
ASEDIT=0x00080000
ASAUDIO=0x00080000
ASCAMERA=0x00080000
ASVIDEO=0x00080000
ASVOICE=0x00080000
BLUELIGH=0x00080000
FREEICLI=0x00080000
HPFIUI=0x00080000
LAPLINK=0x00080000
LAUNCH=0x00080000
LEXBCES=0x00080000
MNGREG32=0x00080000
MOTODV=0x00080000
POINT32=0x00080002
SA6REG=0x00080000
SETUP=0x00080000
SETUP2=0x00080000
WEBEX=0x00100000
AGENTSVR=0x00000002
MSOOBE=0x00000002

[ModuleCompatibility]
ACEROOBE=0x0004
AIRNFM=0x0002
ALDNCD=0x0002
AMRES=0x0002
ATM=0x0002
ARCHANGEL=0x0002
CSNOV=0x0002
DEFDEMO=0x0002
DIBWND=0x0002
DIB=0x0002
DS=0x0001
EMLIB=0x0002
EMSAVE=0x0002
FH4=0x0002
GEDIT=0x0002
GEORGE=0x0002
GVBSETUP=0x0002
HRWCD=0x0002
ISLFAXPR=0x0002
KIDDESK=0x0002
KIDSTYPE=0x0000
KNPS=0x0002
LIONKING=0x0002
MAUI_DRV=0x0002
MGXWMF=0x0002
MEMMAP=0x0002
MSARTIST=0x0002
MSCRWRTR=0x0002
MSCUISTF=0x0001
MVIEWER2=0x0002
MWAVSCAN=0x0002
MYINV=0x0002
OLESVR=0x0002
PDOXWIN=0x0002
PLANIT=0x0002
PP3=0x0002
PP4=0x0002
PPPP=0x0002
PXDSRV2=0x0002
REVIEWRT=0x0002
ROULETTE=0x0002
RRIRJ=0x0002
RR1=0x0002
RR2CD=0x0002
STL_DLG=0x0002
TECO=0x0001
TER=0x0002
TLW0LOC=0x0002
TMSWIN=0x0002
USA=0x0002
VOICE=0x0002
WFXVIEW=0x0004
WINFORM=0x0002
WPWIN61=0x0002

[TrueType]
FontSmoothing=0

[mci extensions]
mid=Sequencer
rmi=Sequencer
wav=waveaudio
avi=AVIVideo
cda=CDAudio
aif=MPEGVideo
aifc=MPEGVideo
aiff=MPEGVideo
au=MPEGVideo
m1v=MPEGVideo
m3u=MPEGVideo
midi=Sequencer
mov=MPEGVideo
mp2=MPEGVideo
mp3=MPEGVideo
mpa=MPEGVideo
mpe=MPEGVideo
mpeg=MPEGVideo
mpg=MPEGVideo
mpv2=MPEGVideo
qt=MPEGVideo
snd=MPEGVideo
asf=MPEGVideo2
asx=MPEGVideo2
ivf=MPEGVideo2
mp2v=MPEGVideo
wax=MPEGVideo2
wvx=MPEGVideo2
wm=MPEGVideo2
wmx=MPEGVideo2
wma=MPEGVideo2
wmp=MPEGVideo2
wmv=MPEGVideo2
wpl=MPEGVideo2

[MCICompatibility]
QTWVideo=0x0001
MCIXSND=0x0001
GDAnim=0x0001

[mciavi]

[Desktop_Shell]
Current=Win

[Pscript.Drv]
ATMWorkaround=1

[Ports]
LPT1:=
LPT2:=
LPT3:=
COM1:=9600,n,8,1,x
COM2:=9600,n,8,1,x
COM3:=9600,n,8,1,x
COM4:=9600,n,8,1,x
FILE:=

[embedding]

[Extensions]
ZIP=C:\PROGRA~1\WINZIP\winzip32.exe ^.ZIP
LZH=C:\PROGRA~1\WINZIP\winzip32.exe ^.LZH
ARJ=C:\PROGRA~1\WINZIP\winzip32.exe ^.ARJ
ARC=C:\PROGRA~1\WINZIP\winzip32.exe ^.ARC
TAR=C:\PROGRA~1\WINZIP\winzip32.exe ^.TAR
TAZ=C:\PROGRA~1\WINZIP\winzip32.exe ^.TAZ
TGZ=C:\PROGRA~1\WINZIP\winzip32.exe ^.TGZ
TZ=C:\PROGRA~1\WINZIP\winzip32.exe ^.TZ
GZ=C:\PROGRA~1\WINZIP\winzip32.exe ^.GZ
Z=C:\PROGRA~1\WINZIP\winzip32.exe ^.Z
CAB=C:\PROGRA~1\WINZIP\winzip32.exe ^.CAB
UU=C:\PROGRA~1\WINZIP\winzip32.exe ^.UU
UUE=C:\PROGRA~1\WINZIP\winzip32.exe ^.UUE
XXE=C:\PROGRA~1\WINZIP\winzip32.exe ^.XXE
B64=C:\PROGRA~1\WINZIP\winzip32.exe ^.B64
HQX=C:\PROGRA~1\WINZIP\winzip32.exe ^.HQX
BHX=C:\PROGRA~1\WINZIP\winzip32.exe ^.BHX
MIM=C:\PROGRA~1\WINZIP\winzip32.exe ^.MIM

[Devices]
HP DeskJet 840C Series=hpf9xdr0,LPT1:

[PrinterPorts]
HP DeskJet 840C Series=hpf9xdr0,LPT1:,15,45

[Sounds]
SystemDefault=,

[MCI Extensions.BAK]
aif=MPEGVideo
aifc=MPEGVideo
aiff=MPEGVideo
au=MPEGVideo
m1v=MPEGVideo
m3u=MPEGVideo
midi=MPEGVideo
mov=MPEGVideo
mp2=MPEGVideo
mp3=MPEGVideo
mpa=MPEGVideo
mpe=MPEGVideo
mpeg=MPEGVideo
mpg=MPEGVideo
mpv2=MPEGVideo
qt=MPEGVideo
snd=MPEGVideo
asf=MPEGVideo2
asx=MPEGVideo2
ivf=MPEGVideo2
mp2v=MPEGVideo
wax=MPEGVideo2
wvx=MPEGVideo2
wm=MPEGVideo2
wmx=MPEGVideo2
wma=MPEGVideo2
wmp=MPEGVideo2
wmv=MPEGVideo2
wpl=MPEGVideo2

[WAOL]
AppPath=C:\AMERICA ONLINE 5.0A
InstallDrive=D
SharedPath=C:\WINDOWS\AOLSHARE

[WinZip]
Note-1=This section is required only to install the optional WinZip Internet Browser Support build 0231.
Note-2=Removing this section of the win.ini will have no effect except preventing installation of WinZip Internet Browser Support build 0231.
win32_version=6.3-8.0

[aphex]
uid=UK3CpFkC-Z6JaF4NBD-PHXDQ5ZlL-MoUrKMTnB

[Mail]
MAPI=1
MAPIX=1
CMC=1
CMCDLLNAME=mapi.dll
CMCDLLNAME32=mapi32.dll
MAPIXVER=1.0.0.1
OLEMessaging=1

[colors]
Scrollbar=212 208 200
Background=58 110 165
ActiveTitle=10 36 106
InactiveTitle=128 128 128
Menu=212 208 200
Window=255 255 255
WindowFrame=0 0 0
MenuText=0 0 0
WindowText=0 0 0
TitleText=255 255 255
ActiveBorder=212 208 200
InactiveBorder=212 208 200
AppWorkspace=128 128 128
Hilight=10 36 106
HilightText=255 255 255
ButtonFace=212 208 200
ButtonShadow=128 128 128
GrayText=128 128 128
ButtonText=0 0 0
InactiveTitleText=212 208 200
ButtonHilight=255 255 255
ButtonDkShadow=64 64 64
ButtonLight=212 208 200
InfoText=0 0 0
InfoWindow=255 255 225
ButtonAlternateFace=181 181 181
HotTrackingColor=0 0 128
GradientActiveTitle=166 202 240
GradientInactiveTitle=192 192 192


----------



## shoeby2

And here's the system.ini

[boot]
oemfonts.fon=vgaoem.fon
shell=Explorer.exe
system.drv=system.drv
drivers=mmsystem.dll power.drv
user.exe=user.exe
gdi.exe=gdi.exe
sound.drv=mmsound.drv
dibeng.drv=dibeng.dll
comm.drv=comm.drv
mouse.drv=mouse.drv
keyboard.drv=keyboard.drv
*DisplayFallback=0
fonts.fon=vgasys.fon
fixedfon.fon=vgafix.fon
386Grabber=vgafull.3gr
display.drv=pnpdrvr.drv
SCRNSAVE.EXE=C:\WINDOWS\A_ADAMS.SCR

[keyboard]
keyboard.dll=
oemansi.bin=
subtype=
type=4

[boot.description]
system.drv=Standard PC
mouse.drv=Microsoft Mouse
keyboard.typ=Standard 101/102-Key or Microsoft Natural Keyboard
aspect=100,96,96
display.drv=NVIDIA RIVA TNT2 Model 64/Model 64 Pro

[386Enh]
ebios=*ebios
woafont=dosapp.fon
mouse=*vmouse, msmouse.vxd
device=*dynapage
device=*vcd
device=*vpd
device=*int13
display=*vdd,*vflatd
device=*enable
EMMExclude=C000-CFFF,C000-CFFF,C000-CFFF
MinPagingFileSize=261388
PagingDrive=C:

[NonWindowsApp]
TTInitialSizes=4 5 6 7 8 9 10 11 12 13 14 15 16 18 20 22

[power.drv]

[drivers]
wavemapper=*.drv
MSACM.imaadpcm=*.acm
MSACM.msadpcm=*.acm
MSVideo.LVfWWDM=lvfwwdm.drv
MSVideo.VfWWDM=vfwwdm.drv
wave=mmsystem.dll
midi=mmsystem.dll

[iccvid.drv]

[mciseq.drv]

[mci]
cdaudio=mcicda.drv
sequencer=mciseq.drv
waveaudio=mciwave.drv
avivideo=mciavi.drv
videodisc=mcipionr.drv
vcr=mcivisca.drv
MPEGVideo=mciqtz.drv
MPEGVideo2=mciqtz.drv

[vcache]

[Password Lists]
BRIAN=C:\WINDOWS\BRIAN.PWL

[MSNP32]

[drivers32]
msacm.lhacm=lhacm.acm
VIDC.VDOM=vdowave.drv
msacm.msg711=msg711.acm
vidc.CVID=iccvid.dll
VIDC.IV31=ir32_32.dll
VIDC.IV32=ir32_32.dll
vidc.MSVC=msvidc32.dll
VIDC.MRLE=msrle32.dll
msacm.msg723=msg723.acm
vidc.M263=msh263.drv
vidc.M261=msh261.drv
VIDC.IV50=ir50_32.dll
msacm.iac2=C:\WINDOWS\SYSTEM\IAC25_32.AX
msacm.msaudio1=msaud32.acm
msacm.sl_anet=sl_anet.acm
MSACM.imaadpcm=imaadp32.acm
MSACM.msadpcm=msadp32.acm
MSACM.msgsm610=msgsm32.acm
MSACM.trspch=tssoft32.acm
msacm.l3acm=l3codecx.acm
VIDC.IV41=ir41_32.ax
VIDC.IV31=ir32_32.dll
VIDC.IV32=ir32_32.dll
vidc.dvsd=dvc.dll
VIDC.CVID=iccvid.dll
msacm.voxacm160=vct3216.acm
VIDC.YVU9=lvcodec2.dll
VIDC.I420=nuvyuv.dll
VIDC.YUY2=msyuv.dll
VIDC.UYVY=msyuv.dll
VIDC.YVYU=msyuv.dll
VIDC.NTN1=NUVision.ax

[TTFontDimenCache]
0 4=2 4
0 5=3 5
0 6=4 6
0 7=4 7
0 8=5 8
0 9=5 9
0 10=6 10
0 11=7 11
0 12=7 12
0 13=8 13
0 14=8 14
0 15=9 15
0 16=10 16
0 18=11 18
0 20=12 20
0 22=13 22


----------



## ~Candy~

Nothing looks out of place there.

I stumbled across this, so I'll throw it out for consideration in case it rings a bell with anyone.

http://support.microsoft.com/default.aspx?scid=kb;en-us;188114

Also, would an overinstall of Windows be traumatic for anyone?


----------



## ~Candy~

violatio said:


> Hiya,
> 
> just wondeirng if the problem has been solved ? Coz i'm currently facing the same problem. Using a Toshiba Laptop with Windows XP. Thing is, the 'powrprof.dll could not load" dialog box has a heading of THOTKEY.EXE.
> 
> i wonder if that might be the problem...


Try turning off hotkey via start, run, msconfig, startup.


----------



## Ted46

Now mind you, this computer, not the one I'm on now, is basically
setup for my Amateur Radio junk. I had a virus, used AVG and 
it caught the virus, went to reboot and that's when all of the fun
began..

Now, I have done just about everything I've seen listed here
and still get the errors.. 

Question is, should I reformat both C and D or just C?

Ted


----------



## eddie5659

Hiya and welcome, Ted

Are you getting the exact same error? As to the format, are you using a partitioned drive, or is D your CDROM?

eddie


----------



## Ted46

C is the main drive, D is my back up drive and E is the CDrom...


----------



## eddie5659

Well, if you really want to format, and I hardly ever use that word, its taboo with me  , then just your C drive, as the backup drive is exactly that. 

However, is this a HP, Dell or something like that? If so, be careful as I had problems with a HP drive, and the restore drive may be necessary for the reinstall of Windows.

eddie


----------



## BobParagon

Hi Guys,

I've got to admire your persistence. I probably would've given up long ago. I don't have a lot of experience with ME, but I go back a few years and when Windows 3.11 was big the system.ini and win.ini files were everything. I don't know if you need the power management features or not, but what you might try doing is removing 'power.drv' from the [boot] section of the system.ini file at the line that says

drivers=mmsystem.dll power.drv

Also, go into msconfig and uncheck all the references to power management. If you still get the error messages, you may have to go back into the registry and delete the references in the Run, RunOnce, etc... sections.

If you do need the power management features, you might try getting a copy of power.drv from a good computer. I'm not sure where it goes, but I think it was in \Windows\System.

Good Luck.


----------



## eddie5659

Hiya and welcome, BobParagon 

Thanks for replying to this thread, I never like to give up on them, can you guess 

eddie


----------



## shoeby2

Hi Eddie, it's Brian. I'm back! To summarize, I bought a new computer, everything runs great. But in the meantime, I've remodeled my basement and now would like to run both my old machine (the one with the problems) and my new one, as a network. 

So, I did a format on the old computer and a scandisk. Everything was downhill from there. The scandisk was taking so long that I went to bed. In the morning it was finished but the hard drive was making a clicking sound. After reading many posts I figured my hard drive was dead. Fine with me. I've installed the new hard drive but now I can't get my CD-ROM to boot up the Win98 recovery disk. It keeps saying "no driver found, aborting installation." And also "device driver not found, "MSCD001". "No valid CD-ROMdevice drivers selected." The CD-ROM is OTI-91X ATAPI, Rev D91XV352. In the BIOS I have the boot selection as Floppy, hard drive and then CD-ROM. 

I'm not sure, should I post this in the hardware thread?

Thanks!

Brian


----------



## shoeby2

Eddie, 

Just an update. I reset my BIOS and I finally got my CD-ROM to be recognized. Then I was able to reboot using my WIN98 recovery CD. I bought the XP upgrade so I'll do that next, and then work on networking old and new.

Hope all is well with you.

Brian


----------



## eddie5659

Hiya Brian

I'm fine, I did mange to solve a long thread in Software, but its a shame we never managed to get this one solved 

Hope you had a good christmas, I did as the beer was flowing nearly every night 

The XP upgrade should go okay, though I've never actually done one. I have upgraded to 2000 (on it now), and it was straight forward. 

As this one is now kinda Solved, shall we make it solved? Also, the amount of people that have replied here, and the suggestions, has made this thread an informative one (bookmarking it now).

eddie


----------



## shoeby2

Hey Eddie, 

XP upgrade worked fine, giving me new life to my old machine. I agree that we should make the thread solved, even if it was through an upgrade.

Thanks, 
Brian


----------



## eddie5659

Oki doki, will do 

Have fun with the new..er, old..pc 

eddie


----------

