# [Resolved] have win me2000 will not shut down



## yiksney (Jan 16, 2003)

win me 2000 will not shut down 
tried dr watson it points to mmtask.tsk as error 
? how to fix or what to do?


----------



## Rollin' Rog (Dec 9, 2000)

yiksney welcome to TSG. I'm going to assume you have WinME, since there is no such animal as WinME 2000.

In any case could you provide us with a post of your startups using the StartupList application from the site below. Just download, unzip and run it, then copy/paste the results to a reply.

http://www.lurkhere.com/~nicefiles/

And how long has the problem existed, have you installed or uninstalled anything in the last few days? What exactly happens when you try to shut down, is it hanging on a specific screen or rebooting?


----------



## yiksney (Jan 16, 2003)

yiksney welcome to TSG. I'm going to assume you have WinME, since there is no such animal as WinME 2000.

In any case could you provide us with a post of your startups using the StartupList application from the site below. Just download, unzip and run it, then copy/paste the results to a reply.

http://www.lurkhere.com/~nicefiles/

And how long has the problem existed, have you installed or uninstalled anything in the last few days? What exactly happens when you try to shut down, is it hanging on a specific screen or rebooting?

i got to the site to download start up files it stopped at 99 % trying to load choose download from this location
2nd attempt using 3 1/2 floppy it said file completed but when tried to open nothing / and using file open 3 12 floppy it does not appear in list of whats on floppy 
unistlled PAL TALK after probolem began
have tried system restore using jan 1 2003 as restore date 
because problem began after that about a week old now
computer will not shut down have to turn off electric power
it hangs /freezes after shut down command the screen goes blank with a cursor flashing at upper right hand corner
i deleted some unkown thing out of starup menu today 
i could figure out how to unistall it so just deleted and then emptied recycle bin of it
i am no expert thank you for bearing with


----------



## yiksney (Jan 16, 2003)

PK
this is what i got using word 
when i attempted to get start up files 
arg 
PK
now it has disappeared i did a select all then copy it 
and it did not paste it here 
jees 
each step is not working nothing is working


----------



## Rollin' Rog (Dec 9, 2000)

When you try to save the startuplist.zip, right click on the downlowad url and select "save target as". When prompted for a download directory, select the Desktop.

The file should download as .zip file so you need a zip program to unzip it (extract), only when you have startuplist.exe extracted can you run it.

If you cannot succeed in getting the StartpList to run, try downloading the following program to the desktop; then doubleclick it to run and copy/paste the Startup.log, (but not the stubpaths.txt file) to a reply.

http://home.earthlink.net/~rmbox/Reticulated/4IE_Only/StartLog.com


----------



## yiksney (Jan 16, 2003)

yiksney use to id me
wrote to u about winme not shutiing down
ur reply go to page download startup file finder
tried got froze at 99% = run from this location
tried save to disc it went on a floppy
aol could not open to copy and paste
tried word pad opened as code i think all jibberish 
tried to copy and apste that to send u would work
not sure how to respond to u on this even
where prev reply are ? etc 
u asked when problem occured about a week ago
after problem i unistalled PAL TALK never used it 
did not help
looked at HELP SECTION ..........not much help
dr watson thing says mmtask.tsk try to quit or i dont remember what it said .......but have no idea how to do that either
have used search to get list of start up list 
it shows 2 files that look like they dont belong
c:\windows\system\khooker
c:\windows\system\mp_s3exe
i do not know how to unistall these or how to delete them
yiksney
an email says u replied but when i copy the whole address it wont open says try another spelling so i just opened this and tried to reply here 
arg


----------



## Rollin' Rog (Dec 9, 2000)

yiksney, do NOT Left Click on the url below, you do not want to run it from current location.

RIGHT CLICK on it.

You will see a menu that includes "Save Target As". Choose that.

You should then see a window which allows you to select where to save it to. Left Click the Desktop icon. Then Left Click "Save". It should only take a second. Then go to your desktop and double left click the file to run it.

When it has run, you will see a log named "Startup.log". Click Edit>Select All>Edit>Copy and then paste the copied text to a reply here. OR attach the file using the "attach" button

http://home.earthlink.net/~rmbox/Reticulated/4IE_Only/StartLog.com

by the way, the khooker file is for your Video Drivers, I don't know what the other is.

You should also try running an Online Virus Scan. Try to run HouseCall. This one you do left click on...

http://housecall.trendmicro.com/housecall/start_corp.asp


----------



## Rollin' Rog (Dec 9, 2000)

This entry indicates you have the "Klez" worm.

"Winkkl"="C:\\WINDOWS\\SYSTEM\\Winkkl.exe"

To remove it you will need a removal tool such as the one from Symantec that I'm going to link you to. You must follow their instructions for disabling System Restore before running it. And then reboot in Safe Mode to do so.

Follow the instruction under "Obtaining and Running the Tool"; Read down lower on how to disable System Restore in WinME.

http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.removal.tool.html

When you have finished, give us another post of your startups. If you can get the other StartupList program great (follow the same directions for downloading, then unzip and run it), but otherwise, just re-run the one you have now. I believe WinME has its own zip utility so you may not need one to unzip a file with a .zip extension. This is not to be confused with a "zip drive" which is something entirely different.

You also have some "spyware", but we will address that after Klez is cleaned off the system


----------



## yiksney (Jan 16, 2003)

here is new list after i did get the klez remover to work 
after soem trial and error

---------- C:\WINDOWS\desktop\StartUp.Log

Start-Ups checked at 01-17-2003 2:31:18.74a 
__________________________________________________________________________ 
__________________________________________________________________________

StartUp Log for Windows 95/98 - Freeware by rmbox 
__________________________________________________________________________ 
__________________________________________________________________________

Comments:

This is a log of all the programs on your computer that 
are starting automatically every time you start Windows. 
Using this log can be a quick way to spot trojans.

StartUp Log (version 1.58) - Release Date 11/9/2002

__________________________________________________________________________ 
__________________________________________________________________________

StartUp Log Index

1. HKLM Run 
2. HKCU Run 
3. HKLM RunOnce 
4. HKCU RunOnce 
5. HKLM RunServices 
6. HKLM RunServicesOnce 
7. WIN.INI file 
8. SYSTEM.INI file 
9. AUTOEXEC.BAT file 
10. StartUp folder 
11. All Users StartUp 
12. Misc. StartUp Configurations

__________________________________________________________________________ 
__________________________________________________________________________

The following is a list of your current Start-Ups 
__________________________________________________________________________ 
__________________________________________________________________________

1. HKLM Run - Registry

[RegPath] 
"StartUp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TaskMonitor"="C:\\WINDOWS\\taskmon.exe"
"PCHealth"="C:\\WINDOWS\\PCHealth\\Support\\PCHSchd.exe -s"
"SystemTray"="SysTray.Exe"
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
"SiSAudio"="C:\\WINDOWS\\system\\MP_S3.exe"
"SiS Tray"=""
"SiS KHooker"="C:\\WINDOWS\\SYSTEM\\khooker.exe"
"PCTVOICE"="pctvoice.exe"
"CMESys"="\"C:\\PROGRAM FILES\\COMMON FILES\\CMEII\\CMESYS.EXE\""
"Mirabilis ICQ"="C:\\Program Files\\ICQ\\NDetect.exe"
"RealTray"="C:\\Program Files\\Real\\RealPlayer\\RealPlay.exe SYSTEMBOOTHIDEPLAYER"

========================================================================== 
__________________________________________________________________________

2. HKCU Run - Registry

[RegPath] 
"StartUp"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Mozilla Quick Launch"="\"C:\\Program Files\\Netscape\\Netscape\\Netscp.exe\" -turbo"

========================================================================== 
__________________________________________________________________________

3. HKLM RunOnce - Registry

[RegPath] 
"StartUp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

========================================================================== 
__________________________________________________________________________

4. HKCU RunOnce - Registry

[RegPath] 
"StartUp"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ICQ"="C:\\PROGRAM FILES\\ICQ\\ICQ.EXE -trayboot"

========================================================================== 
__________________________________________________________________________

5. HKLM RunServices - Registry

[RegPath] 
"StartUp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
"SchedulingAgent"="mstask.exe"
"*StateMgr"="C:\\WINDOWS\\System\\Restore\\StateMgr.exe"

========================================================================== 
__________________________________________________________________________

6. HKLM RunServicesOnce - Registry

[RegPath] 
"StartUp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

========================================================================== 
__________________________________________________________________________

7. WIN.INI File - (c:\windows\win.ini)

Your win.ini run/load lines should look like run= and load= exclusively. 
There should be nothing to the right of the equal signs.

These are the run and load lines in your WIN.INI file

run=

load=

========================================================================== 
__________________________________________________________________________

8. SYSTEM.INI File - (c:\windows\system.ini)

Your system.ini shell line should look like shell=Explorer.exe exclusively. 
You should only see Explorer.exe following the equal sign.

This is the shell line in your SYSTEM.INI file

shell=Explorer.exe

========================================================================== 
__________________________________________________________________________

9. AUTOEXEC.BAT File - (c:\autoexec.bat)

(Some trojans have been known to start from this file)

These are your program startups and set paths in your autoexec.bat file

========================================================================== 
__________________________________________________________________________

10. StartUp Folder - (c:\windows\start menu\programs\startup)

Shortcuts to any program will automatically start when placed here.

These are the shortcuts located in your StartUp folder

C:\WINDOWS\Start Menu\Programs\StartUp\AlarOnli.lnk
C:\WINDOWS\Start Menu\Programs\StartUp\America Online 8.0 Tray Icon.lnk
C:\WINDOWS\Start Menu\Programs\StartUp\GStartup.lnk
C:\WINDOWS\Start Menu\Programs\StartUp\PrecisionTime.lnk
C:\WINDOWS\Start Menu\Programs\StartUp\Date Manager.lnk
C:\WINDOWS\Start Menu\Programs\StartUp\Gator eWallet.lnk
C:\WINDOWS\Start Menu\Programs\StartUp\Microsoft Find Fast.lnk
C:\WINDOWS\Start Menu\Programs\StartUp\Office Startup.lnk

========================================================================== 
__________________________________________________________________________

11. All Users Folder - (c:\windows\all users\start menu\programs\startup)

Shortcuts to any program will automatically start when placed here.

These are the shortcuts located in your All Users StartUp folder

*(No start-ups found)*

========================================================================== 
__________________________________________________________________________

12. Miscellaneous StartUp Configurations

-============================- 
Registry StartUp Directories 
-============================-

Should show the Start Menu StartUp and All Users StartUp directories

.....................................................................

[1] HKCU - Shell Folders

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

"Startup"="C:\\WINDOWS\\Start Menu\\Programs\\StartUp"

.....................................................................

[2] HKCU - User Shell Folders

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

.....................................................................

[3] HKLM - Shell Folders

HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders

"Common Startup"="C:\\WINDOWS\\All Users\\Start Menu\\Programs\\StartUp"

.....................................................................

[4] HKLM - User Shell Folders

HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\User Shell Folders

.....................................................................

-=======================- 
Registry Shell Spawning 
-=======================-

Open Commands for Executable File Types

@="\"%1\" %*"
(.exe file - RegPath = HKCR\exefile\shell\open\command)

@="\"%1\" %*"
(.com file - RegPath = HKCR\comfile\shell\open\command)

@="\"%1\" /S"
(.scr file - RegPath = HKCR\scrfile\shell\open\command)

@="\"%1\" %*"
(.bat file - RegPath = HKCR\batfile\shell\open\command)

@="\"%1\" %*"
(.pif file - RegPath = HKCR\piffile\shell\open\command)

@="C:\\WINDOWS\\SYSTEM\\MSHTA.EXE \"%1\" %*"
(.hta file - RegPath = HKCR\htafile\shell\open\command)

-=========================- 
HKLM RunOnceEx - Registry 
-=========================-

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx]

-=========================- 
HKU (.Default) Run - Registry 
-=========================-

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Run]
"Mozilla Quick Launch"="\"C:\\Program Files\\Netscape\\Netscape\\Netscp.exe\" -turbo"

-==============================- 
HKU (.Default) RunOnce - Registry 
-==============================-

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ICQ"="C:\\PROGRAM FILES\\ICQ\\ICQ.EXE -trayboot"

-================================- 
StubPaths - Registry (Partial Listing) 
-================================-

(Please see the StubPath.txt on your desktop for complete listing)

HKLM\Software\Microsoft\Active Setup\Installed Components

"StubPath"="C:\\WINDOWS\\msnmgsr1.exe"
"StubPath"="C:\\WINDOWS\\COMMAND\\sulfnbk.exe /L"
"StubPath"=""
"StubPath"="\"C:\\PROGRA~1\\OUTLOO~1\\setup50.exe\" /APP:OE /CALLER:IE50 /user /install"
"StubPath"="\"C:\\PROGRA~1\\OUTLOO~1\\setup50.exe\" /APP:WAB /CALLER:IE50 /user /install"
"StubPath"="C:\\WINDOWS\\SYSTEM\\ie4uinit.exe"
"StubPath"="C:\\WINDOWS\\SYSTEM\\updcrl.exe -e -u C:\\WINDOWS\\SYSTEM\\verisignpub1.crl"

-=================- 
WINSTART.BAT File - (c:\windows\winstart.bat) 
-=================-

@C:\WINDOWS\tmpcpyis.bat

-=================- 
WININIT.BAK File - (c:\windows\wininit.bak) 
(name) (type) (size)(modified)(time) 
wininit bak 56 01-16-03 10:09a
-=================-

[Rename]
NUL=C:\PROGRA~1\AMERIC~1.0\JITI\REAL9_~1.EXE
-=====================- 
Screen Saver Settings (Possible system.ini start-up) 
-=====================-

SCRNSAVE.EXE=C:\WINDOWS\SYSTEM\3DCHRI~1.SCR

========================================================================== 
__________________________________________________________________________

- Supplemental Environment Information -

COMSPEC=C:\WINDOWS\COMMAND.COM
PATH=C:\WINDOWS;C:\WINDOWS\COMMAND
TEMP=C:\WINDOWS\TEMP
TMP=C:\WINDOWS\TEMP
winbootdir=C:\WINDOWS
windir=C:\WINDOWS

File - c:\windows\Wininit.bak 
File - c:\windows\deletefi.ini

========================================================================== 
__________________________________________________________________________

- End -


----------



## yiksney (Jan 16, 2003)

i went online and found a spyware removal ran it it said removed items ? here is new list 
i get lost when ur talking about zip and exe etc 
thanks for your help is was very good

---------- C:\WINDOWS\desktop\StartUp.Log

Start-Ups checked at 01-17-2003 10:58:52.12a 
__________________________________________________________________________ 
__________________________________________________________________________

StartUp Log for Windows 95/98 - Freeware by rmbox 
__________________________________________________________________________ 
__________________________________________________________________________

Comments:

This is a log of all the programs on your computer that 
are starting automatically every time you start Windows. 
Using this log can be a quick way to spot trojans.

StartUp Log (version 1.58) - Release Date 11/9/2002

__________________________________________________________________________ 
__________________________________________________________________________

StartUp Log Index

1. HKLM Run 
2. HKCU Run 
3. HKLM RunOnce 
4. HKCU RunOnce 
5. HKLM RunServices 
6. HKLM RunServicesOnce 
7. WIN.INI file 
8. SYSTEM.INI file 
9. AUTOEXEC.BAT file 
10. StartUp folder 
11. All Users StartUp 
12. Misc. StartUp Configurations

__________________________________________________________________________ 
__________________________________________________________________________

The following is a list of your current Start-Ups 
__________________________________________________________________________ 
__________________________________________________________________________

1. HKLM Run - Registry

[RegPath] 
"StartUp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TaskMonitor"="C:\\WINDOWS\\taskmon.exe"
"PCHealth"="C:\\WINDOWS\\PCHealth\\Support\\PCHSchd.exe -s"
"SystemTray"="SysTray.Exe"
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
"SiSAudio"="C:\\WINDOWS\\system\\MP_S3.exe"
"SiS Tray"=""
"SiS KHooker"="C:\\WINDOWS\\SYSTEM\\khooker.exe"
"PCTVOICE"="pctvoice.exe"
"Mirabilis ICQ"="C:\\Program Files\\ICQ\\NDetect.exe"
"RealTray"="C:\\Program Files\\Real\\RealPlayer\\RealPlay.exe SYSTEMBOOTHIDEPLAYER"

========================================================================== 
__________________________________________________________________________

2. HKCU Run - Registry

[RegPath] 
"StartUp"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Mozilla Quick Launch"="\"C:\\Program Files\\Netscape\\Netscape\\Netscp.exe\" -turbo"

========================================================================== 
__________________________________________________________________________

3. HKLM RunOnce - Registry

[RegPath] 
"StartUp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

========================================================================== 
__________________________________________________________________________

4. HKCU RunOnce - Registry

[RegPath] 
"StartUp"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ICQ"="C:\\PROGRAM FILES\\ICQ\\ICQ.EXE -trayboot"

========================================================================== 
__________________________________________________________________________

5. HKLM RunServices - Registry

[RegPath] 
"StartUp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
"SchedulingAgent"="mstask.exe"
"*StateMgr"="C:\\WINDOWS\\System\\Restore\\StateMgr.exe"

========================================================================== 
__________________________________________________________________________

6. HKLM RunServicesOnce - Registry

[RegPath] 
"StartUp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

========================================================================== 
__________________________________________________________________________

7. WIN.INI File - (c:\windows\win.ini)

Your win.ini run/load lines should look like run= and load= exclusively. 
There should be nothing to the right of the equal signs.

These are the run and load lines in your WIN.INI file

run=

load=

========================================================================== 
__________________________________________________________________________

8. SYSTEM.INI File - (c:\windows\system.ini)

Your system.ini shell line should look like shell=Explorer.exe exclusively. 
You should only see Explorer.exe following the equal sign.

This is the shell line in your SYSTEM.INI file

shell=Explorer.exe

========================================================================== 
__________________________________________________________________________

9. AUTOEXEC.BAT File - (c:\autoexec.bat)

(Some trojans have been known to start from this file)

These are your program startups and set paths in your autoexec.bat file

========================================================================== 
__________________________________________________________________________

10. StartUp Folder - (c:\windows\start menu\programs\startup)

Shortcuts to any program will automatically start when placed here.

These are the shortcuts located in your StartUp folder

C:\WINDOWS\Start Menu\Programs\StartUp\AlarOnli.lnk
C:\WINDOWS\Start Menu\Programs\StartUp\America Online 8.0 Tray Icon.lnk
C:\WINDOWS\Start Menu\Programs\StartUp\Microsoft Find Fast.lnk
C:\WINDOWS\Start Menu\Programs\StartUp\Office Startup.lnk

========================================================================== 
__________________________________________________________________________

11. All Users Folder - (c:\windows\all users\start menu\programs\startup)

Shortcuts to any program will automatically start when placed here.

These are the shortcuts located in your All Users StartUp folder

*(No start-ups found)*

========================================================================== 
__________________________________________________________________________

12. Miscellaneous StartUp Configurations

-============================- 
Registry StartUp Directories 
-============================-

Should show the Start Menu StartUp and All Users StartUp directories

.....................................................................

[1] HKCU - Shell Folders

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

"Startup"="C:\\WINDOWS\\Start Menu\\Programs\\StartUp"

.....................................................................

[2] HKCU - User Shell Folders

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

.....................................................................

[3] HKLM - Shell Folders

HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders

"Common Startup"="C:\\WINDOWS\\All Users\\Start Menu\\Programs\\StartUp"

.....................................................................

[4] HKLM - User Shell Folders

HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\User Shell Folders

.....................................................................

-=======================- 
Registry Shell Spawning 
-=======================-

Open Commands for Executable File Types

@="\"%1\" %*"
(.exe file - RegPath = HKCR\exefile\shell\open\command)

@="\"%1\" %*"
(.com file - RegPath = HKCR\comfile\shell\open\command)

@="\"%1\" /S"
(.scr file - RegPath = HKCR\scrfile\shell\open\command)

@="\"%1\" %*"
(.bat file - RegPath = HKCR\batfile\shell\open\command)

@="\"%1\" %*"
(.pif file - RegPath = HKCR\piffile\shell\open\command)

@="C:\\WINDOWS\\SYSTEM\\MSHTA.EXE \"%1\" %*"
(.hta file - RegPath = HKCR\htafile\shell\open\command)

-=========================- 
HKLM RunOnceEx - Registry 
-=========================-

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx]

-=========================- 
HKU (.Default) Run - Registry 
-=========================-

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Run]
"Mozilla Quick Launch"="\"C:\\Program Files\\Netscape\\Netscape\\Netscp.exe\" -turbo"

-==============================- 
HKU (.Default) RunOnce - Registry 
-==============================-

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ICQ"="C:\\PROGRAM FILES\\ICQ\\ICQ.EXE -trayboot"

-================================- 
StubPaths - Registry (Partial Listing) 
-================================-

(Please see the StubPath.txt on your desktop for complete listing)

HKLM\Software\Microsoft\Active Setup\Installed Components

"StubPath"="C:\\WINDOWS\\msnmgsr1.exe"
"StubPath"="C:\\WINDOWS\\COMMAND\\sulfnbk.exe /L"
"StubPath"=""
"StubPath"="\"C:\\PROGRA~1\\OUTLOO~1\\setup50.exe\" /APP:OE /CALLER:IE50 /user /install"
"StubPath"="\"C:\\PROGRA~1\\OUTLOO~1\\setup50.exe\" /APP:WAB /CALLER:IE50 /user /install"
"StubPath"="C:\\WINDOWS\\SYSTEM\\ie4uinit.exe"
"StubPath"="C:\\WINDOWS\\SYSTEM\\updcrl.exe -e -u C:\\WINDOWS\\SYSTEM\\verisignpub1.crl"

-=================- 
WINSTART.BAT File - (c:\windows\winstart.bat) 
-=================-

@C:\WINDOWS\tmpcpyis.bat

-=================- 
WININIT.BAK File - (c:\windows\wininit.bak) 
(name) (type) (size)(modified)(time) 
wininit bak 56 01-16-03 10:09a
-=================-

[Rename]
NUL=C:\PROGRA~1\AMERIC~1.0\JITI\REAL9_~1.EXE
-=====================- 
Screen Saver Settings (Possible system.ini start-up) 
-=====================-

SCRNSAVE.EXE=C:\WINDOWS\SYSTEM\3DCHRI~1.SCR

========================================================================== 
__________________________________________________________________________

- Supplemental Environment Information -

COMSPEC=C:\WINDOWS\COMMAND.COM
PATH=C:\WINDOWS;C:\WINDOWS\COMMAND
TEMP=C:\WINDOWS\TEMP
TMP=C:\WINDOWS\TEMP
winbootdir=C:\WINDOWS
windir=C:\WINDOWS

File - c:\windows\Wininit.bak 
File - c:\windows\deletefi.ini

========================================================================== 
__________________________________________________________________________

- End - 
the removal program was from spybot ? got it from a search the net


----------



## IMM (Feb 1, 2002)

If it was me - I'd remove the Find Fast indexer
http://support.microsoft.com/default.aspx?scid=kb;en-us;158705
and uncheck the office startup item using msconfig (unless you use this computer almost exclusively for Office apps)


----------



## yiksney (Jan 16, 2003)

was the comments /advice about run msconfig 
for me yiksney to do ?
did the spybot work ?
i did run msconfig the other day in a trial and error saw ir somewhere it might be the answer so i tried it 
so should i do the instructions for the msconfig ?


----------



## yiksney (Jan 16, 2003)

and the file downloaded but when complete the OPEN WITH 
box opened ......i have no idea what to do ? to run it ?


----------



## Rollin' Rog (Dec 9, 2000)

Do a File Search for *scanregw.exe*

You should have a copy in c:\windows

If not you will have to extract it; I'll give you instructions for that later if necessary; right now I have to run.

If it IS there, then download the attached file to your desktop. Remember, right click and choose "save target as". Then, when it has been downloaded, Right click on it and rename it:

*scanregw.reg*

Note the extension is being changed from .txt to .reg

that is important. Once it has changed you should see a registry icon, then double click that and confirm the merge to the registry. You may need to reboot; then check msconfig > startups again and see if Scanregistry is there


----------



## yiksney (Jan 16, 2003)

and is on the desktop
now reboot check msconfig 
will advise yiksney


----------



## yiksney (Jan 16, 2003)

did a file search here are results 
not sure what to do
did check for the scan reg w/the run mscong
not there
tried to send a copy of the search i saved it 
but aol will not open it to attach it 
i do not know how to unzip it arg
am about = to 5yr old child on this 
am trying 
yiksney


----------



## yiksney (Jan 16, 2003)

i see ms find fast 
the other tech man /woman
refered to that ?
i will wait for further orders
thanks


----------



## Rollin' Rog (Dec 9, 2000)

Did you find scanregw.exe when you did a File Search for it? It should be in c:\windows

If the file you downloaded to your desktop is just opening in Wordpad when you click on it, then it has not been renamed properly.

Did you RIGHT click on it and rename it *scanregw.reg*

Once that is done you should see the icon change to a green registry icon. Then double left click on it to merge.

Yes you can Un check Find Fast in msconfig.


----------



## yiksney (Jan 16, 2003)

i tried the rename of the notepad document to scanregw.reg it did not change to a geeen icon remained a word/note pad 
i did un check the find fast in the msconig
the scan reg does not apperar in the msaconfig list however


----------



## yiksney (Jan 16, 2003)

---------- C:\WINDOWS\desktop\StartUp.Log

Start-Ups checked at 01-18-2003 12:36:55.63p 
__________________________________________________________________________ 
__________________________________________________________________________

StartUp Log for Windows 95/98 - Freeware by rmbox 
__________________________________________________________________________ 
__________________________________________________________________________

Comments:

This is a log of all the programs on your computer that 
are starting automatically every time you start Windows. 
Using this log can be a quick way to spot trojans.

StartUp Log (version 1.58) - Release Date 11/9/2002

__________________________________________________________________________ 
__________________________________________________________________________

StartUp Log Index

1. HKLM Run 
2. HKCU Run 
3. HKLM RunOnce 
4. HKCU RunOnce 
5. HKLM RunServices 
6. HKLM RunServicesOnce 
7. WIN.INI file 
8. SYSTEM.INI file 
9. AUTOEXEC.BAT file 
 10. StartUp folder 
11. All Users StartUp 
12. Misc. StartUp Configurations

__________________________________________________________________________ 
__________________________________________________________________________

The following is a list of your current Start-Ups 
__________________________________________________________________________ 
__________________________________________________________________________

1. HKLM Run - Registry

[RegPath] 
"StartUp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TaskMonitor"="C:\\WINDOWS\\taskmon.exe"
"PCHealth"="C:\\WINDOWS\\PCHealth\\Support\\PCHSchd.exe -s"
"SystemTray"="SysTray.Exe"
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
"SiSAudio"="C:\\WINDOWS\\system\\MP_S3.exe"
"SiS Tray"=""
"SiS KHooker"="C:\\WINDOWS\\SYSTEM\\khooker.exe"
"PCTVOICE"="pctvoice.exe"
"Mirabilis ICQ"="C:\\Program Files\\ICQ\\NDetect.exe"
"RealTray"="C:\\Program Files\\Real\\RealPlayer\\RealPlay.exe SYSTEMBOOTHIDEPLAYER"
"MSConfigReminder"="C:\\WINDOWS\\SYSTEM\\msconfig.exe /reminder"

========================================================================== 
__________________________________________________________________________

2. HKCU Run - Registry

[RegPath] 
"StartUp"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Mozilla Quick Launch"="\"C:\\Program Files\\Netscape\\Netscape\\Netscp.exe\" -turbo"

========================================================================== 
__________________________________________________________________________

3. HKLM RunOnce - Registry

[RegPath] 
"StartUp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

========================================================================== 
__________________________________________________________________________

4. HKCU RunOnce - Registry

[RegPath] 
"StartUp"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ICQ"="C:\\PROGRAM FILES\\ICQ\\ICQ.EXE -trayboot"

========================================================================== 
__________________________________________________________________________

5. HKLM RunServices - Registry

[RegPath] 
"StartUp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
"SchedulingAgent"="mstask.exe"
"*StateMgr"="C:\\WINDOWS\\System\\Restore\\StateMgr.exe"

========================================================================== 
__________________________________________________________________________

6. HKLM RunServicesOnce - Registry

[RegPath] 
"StartUp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

========================================================================== 
__________________________________________________________________________

7. WIN.INI File - (c:\windows\win.ini)

Your win.ini run/load lines should look like run= and load= exclusively. 
There should be nothing to the right of the equal signs.

These are the run and load lines in your WIN.INI file

run=

load=

========================================================================== 
__________________________________________________________________________

8. SYSTEM.INI File - (c:\windows\system.ini)

Your system.ini shell line should look like shell=Explorer.exe exclusively. 
You should only see Explorer.exe following the equal sign.

This is the shell line in your SYSTEM.INI file

shell=Explorer.exe

========================================================================== 
__________________________________________________________________________

9. AUTOEXEC.BAT File - (c:\autoexec.bat)

(Some trojans have been known to start from this file)

These are your program startups and set paths in your autoexec.bat file

========================================================================== 
__________________________________________________________________________

10. StartUp Folder - (c:\windows\start menu\programs\startup)

Shortcuts to any program will automatically start when placed here.

These are the shortcuts located in your StartUp folder

C:\WINDOWS\Start Menu\Programs\StartUp\AlarOnli.lnk
C:\WINDOWS\Start Menu\Programs\StartUp\America Online 8.0 Tray Icon.lnk
C:\WINDOWS\Start Menu\Programs\StartUp\Office Startup.lnk

========================================================================== 
__________________________________________________________________________

11. All Users Folder - (c:\windows\all users\start menu\programs\startup)

Shortcuts to any program will automatically start when placed here.

These are the shortcuts located in your All Users StartUp folder

*(No start-ups found)*

========================================================================== 
__________________________________________________________________________

12. Miscellaneous StartUp Configurations

-============================- 
Registry StartUp Directories 
-============================-

Should show the Start Menu StartUp and All Users StartUp directories

.....................................................................

[1] HKCU - Shell Folders

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

"Startup"="C:\\WINDOWS\\Start Menu\\Programs\\StartUp"

.....................................................................

[2] HKCU - User Shell Folders

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

.....................................................................

[3] HKLM - Shell Folders

HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders

"Common Startup"="C:\\WINDOWS\\All Users\\Start Menu\\Programs\\StartUp"

.....................................................................

[4] HKLM - User Shell Folders

HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\User Shell Folders

.....................................................................

-=======================- 
Registry Shell Spawning 
-=======================-

Open Commands for Executable File Types

@="\"%1\" %*"
(.exe file - RegPath = HKCR\exefile\shell\open\command)

@="\"%1\" %*"
(.com file - RegPath = HKCR\comfile\shell\open\command)

@="\"%1\" /S"
(.scr file - RegPath = HKCR\scrfile\shell\open\command)

@="\"%1\" %*"
(.bat file - RegPath = HKCR\batfile\shell\open\command)

@="\"%1\" %*"
(.pif file - RegPath = HKCR\piffile\shell\open\command)

@="C:\\WINDOWS\\SYSTEM\\MSHTA.EXE \"%1\" %*"
(.hta file - RegPath = HKCR\htafile\shell\open\command)

-=========================- 
HKLM RunOnceEx - Registry 
-=========================-

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx]

-=========================- 
HKU (.Default) Run - Registry 
-=========================-

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Run]
"Mozilla Quick Launch"="\"C:\\Program Files\\Netscape\\Netscape\\Netscp.exe\" -turbo"

-==============================- 
HKU (.Default) RunOnce - Registry 
-==============================-

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ICQ"="C:\\PROGRAM FILES\\ICQ\\ICQ.EXE -trayboot"

-================================- 
StubPaths - Registry (Partial Listing) 
-================================-

(Please see the StubPath.txt on your desktop for complete listing)

HKLM\Software\Microsoft\Active Setup\Installed Components

"StubPath"="C:\\WINDOWS\\msnmgsr1.exe"
"StubPath"="C:\\WINDOWS\\COMMAND\\sulfnbk.exe /L"
"StubPath"=""
"StubPath"="\"C:\\PROGRA~1\\OUTLOO~1\\setup50.exe\" /APP:OE /CALLER:IE50 /user /install"
"StubPath"="\"C:\\PROGRA~1\\OUTLOO~1\\setup50.exe\" /APP:WAB /CALLER:IE50 /user /install"
"StubPath"="C:\\WINDOWS\\SYSTEM\\ie4uinit.exe"
"StubPath"="C:\\WINDOWS\\SYSTEM\\updcrl.exe -e -u C:\\WINDOWS\\SYSTEM\\verisignpub1.crl"

-=================- 
WINSTART.BAT File - (c:\windows\winstart.bat) 
-=================-

@C:\WINDOWS\tmpcpyis.bat

-=================- 
WININIT.BAK File - (c:\windows\wininit.bak) 
(name) (type) (size)(modified)(time) 
wininit bak 56 01-16-03 10:09a
-=================-

[Rename]
NUL=C:\PROGRA~1\AMERIC~1.0\JITI\REAL9_~1.EXE
-=====================- 
Screen Saver Settings (Possible system.ini start-up) 
-=====================-

SCRNSAVE.EXE=C:\WINDOWS\SYSTEM\3DCHRI~1.SCR

========================================================================== 
__________________________________________________________________________

- Supplemental Environment Information -

COMSPEC=C:\WINDOWS\COMMAND.COM
PATH=C:\WINDOWS;C:\WINDOWS\COMMAND
TEMP=C:\WINDOWS\TEMP
TMP=C:\WINDOWS\TEMP
winbootdir=C:\WINDOWS
windir=C:\WINDOWS

File - c:\windows\Wininit.bak 
File - c:\windows\deletefi.ini

========================================================================== 
__________________________________________________________________________

- End -


----------



## yiksney (Jan 16, 2003)

i did find the scanregw exe on a file search and it was a green icon 
i ran it and it checked and said do u want to save or backup 
do i still need to get it in the startup list ?
thank you


----------



## Rollin' Rog (Dec 9, 2000)

Yes we need to get it in there; try again to save it through Notepad as a .reg file.

Attached is a pic of what you should see, notice the registry icon which will appear when it is a .reg file

With the file open as a Notepad text file (not Wordpad), make the name *scanregw.reg* and make sure the "save as file type" field shows "All Files"

Once it is saved as a .reg file, run it. You should get a prompt to confirm the merge to the registry.


----------



## yiksney (Jan 16, 2003)

yes it got the icon done as u showed how it would look 
dont understand how to do the next steps 
will reread and try ...when i double left click the icon it scans 
and propmts do u want to backup 
when i right click there is no option to save as ?
am lost


----------



## yiksney (Jan 16, 2003)

yiksney 
i saved it as all files the scanregw
in the run it shows it as a 
c:\windows\desktop\repair\scanregw.reg.txt 
? 
txt file not right ?
i hit run and it opened as looks like note pad 
it did not run or merge ?
do i have to do save as over and type in a change from txt to reg ?
at the end ?


----------



## yiksney (Jan 16, 2003)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"ScanRegistry"="c:\\windows\\scanregw.exe /autorun"
this is what appears after i use RUN 
in NOTEPAD I think it what it is


----------



## Rollin' Rog (Dec 9, 2000)

What you are seeing is what the file looks like when opened in notepad.

Are you saying that happens even when Left clicking on the green registry icon (which should say scanregw.reg)?

Then Right click on the green registry icon, do you see an option to "Merge"? If yes, select that.

You must remove the .txt from the end of this:

scanregw.reg.txt 

To do that Right click on it, select "rename" and just leave it as scanregw.reg -- only then should it appear as a proper registry icon like that in my attachment.


----------



## yiksney (Jan 16, 2003)

with the scanregw is that during several trials with this i have 3 of those scan reg files or icon s the one on desktop is a shortcut one 
i renamed it scanregw.reg 
but right click shows not merge option 
left click runs it a box opens and it checks something then asks
to save registry check 
yiksney


----------



## Rollin' Rog (Dec 9, 2000)

> left click runs it a box opens and it checks something then asks to save registry check


Good enough, that's what we want!

f you clicked 'ok' when seeing that, it should have said something like "successfully merged" and you should now have the ScanRegistry entry in msconfig > startups. Did you check? If it's there you can delete all the scanregw files off the desktop.


----------



## yiksney (Jan 16, 2003)

the scan registry is NOT on the list when i run msconfig
when i 2xleft click the green icon it checks regisrty but does NOT say successfully merged


----------



## yiksney (Jan 16, 2003)

dragged the green registry icon to the start up folder from the start butom program to startup 
it shows in the msconfig list now with a box checked along side
still NO merged prompt 
?
yik


----------



## Rollin' Rog (Dec 9, 2000)

Well one thing you don't want is to put that in your startup folder, do remove that BEFORE proceeding .

I am going to try to give you step-by-step manual instructions for editing the registry. Hopefully you will be able to follow them.

1 -- Click Start>Run and enter *regedit*

2 -- When the Editor opens, on the File Tree, click in order:

*+ Hkey_Local_Machine
+ Software
+ Microsoft
+ Windows
+ CurrentVersion
RUN*

With RUN highlighted, if you don't see ScanRegistry in the Right Hand pane do this:

1 -- Right Click on the *RUN* folder on the left and select: *NEW > STRING VALUE*

>> when you've done that you will see a highlighted entry in the Right pane, under Name, called NewValue.

>> modify that to read: *ScanRegistry* (then just click an empty space on the pane to complete the renaming)

2 -- Once ScanRegistry appears as a name, double left click it (or right click and select "modify")

3 -- An Edit String window will appear. Make the "Value Data" read:

*c:\windows\scanregw.exe /autorun*

(there is a space after .exe)

Click OK

>> If you make a mistake, just right click on the faulty entry in the right hand pane, select "Delete" and start over


----------



## yiksney (Jan 16, 2003)

got to reg edit
no run file/folder
clicked edit find
showed default and a command files
then clicked edit new file
typed scan registry
modify
edit typed c:\windows\scanregw.exe /autorun
file appears on left in result of search ? well its where the default and command were


----------



## yiksney (Jan 16, 2003)

---------- C:\WINDOWS\desktop\StartUp.Log

Start-Ups checked at 01-21-2003 12:23:56.24p 
__________________________________________________________________________ 
__________________________________________________________________________

StartUp Log for Windows 95/98 - Freeware by rmbox 
__________________________________________________________________________ 
__________________________________________________________________________

Comments:

This is a log of all the programs on your computer that 
are starting automatically every time you start Windows. 
Using this log can be a quick way to spot trojans.

StartUp Log (version 1.58) - Release Date 11/9/2002

__________________________________________________________________________ 
__________________________________________________________________________

StartUp Log Index

1. HKLM Run 
2. HKCU Run 
3. HKLM RunOnce 
4. HKCU RunOnce 
5. HKLM RunServices 
6. HKLM RunServicesOnce 
7. WIN.INI file 
8. SYSTEM.INI file 
9. AUTOEXEC.BAT file 
10. StartUp folder 
11. All Users StartUp 
12. Misc. StartUp Configurations

__________________________________________________________________________ 
__________________________________________________________________________

The following is a list of your current Start-Ups 
__________________________________________________________________________ 
__________________________________________________________________________

1. HKLM Run - Registry

[RegPath] 
"StartUp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TaskMonitor"="C:\\WINDOWS\\taskmon.exe"
"PCHealth"="C:\\WINDOWS\\PCHealth\\Support\\PCHSchd.exe -s"
"SystemTray"="SysTray.Exe"
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
"SiSAudio"="C:\\WINDOWS\\system\\MP_S3.exe"
"SiS Tray"=""
"SiS KHooker"="C:\\WINDOWS\\SYSTEM\\khooker.exe"
"PCTVOICE"="pctvoice.exe"
"Mirabilis ICQ"="C:\\Program Files\\ICQ\\NDetect.exe"
"RealTray"="C:\\Program Files\\Real\\RealPlayer\\RealPlay.exe SYSTEMBOOTHIDEPLAYER"

========================================================================== 
__________________________________________________________________________

2. HKCU Run - Registry

[RegPath] 
"StartUp"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Mozilla Quick Launch"="\"C:\\Program Files\\Netscape\\Netscape\\Netscp.exe\" -turbo"

========================================================================== 
__________________________________________________________________________

3. HKLM RunOnce - Registry

[RegPath] 
"StartUp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

========================================================================== 
__________________________________________________________________________

4. HKCU RunOnce - Registry

[RegPath] 
"StartUp"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ICQ"="C:\\PROGRAM FILES\\ICQ\\ICQ.EXE -trayboot"

========================================================================== 
__________________________________________________________________________

5. HKLM RunServices - Registry

[RegPath] 
"StartUp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
"SchedulingAgent"="mstask.exe"
"*StateMgr"="C:\\WINDOWS\\System\\Restore\\StateMgr.exe"

========================================================================== 
__________________________________________________________________________

6. HKLM RunServicesOnce - Registry

[RegPath] 
"StartUp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

========================================================================== 
__________________________________________________________________________

7. WIN.INI File - (c:\windows\win.ini)

Your win.ini run/load lines should look like run= and load= exclusively. 
There should be nothing to the right of the equal signs.

These are the run and load lines in your WIN.INI file

run=

load=

========================================================================== 
__________________________________________________________________________

8. SYSTEM.INI File - (c:\windows\system.ini)

Your system.ini shell line should look like shell=Explorer.exe exclusively. 
You should only see Explorer.exe following the equal sign.

This is the shell line in your SYSTEM.INI file

shell=Explorer.exe

========================================================================== 
__________________________________________________________________________

9. AUTOEXEC.BAT File - (c:\autoexec.bat)

(Some trojans have been known to start from this file)

These are your program startups and set paths in your autoexec.bat file

========================================================================== 
__________________________________________________________________________

10. StartUp Folder - (c:\windows\start menu\programs\startup)

Shortcuts to any program will automatically start when placed here.

These are the shortcuts located in your StartUp folder

C:\WINDOWS\Start Menu\Programs\StartUp\AlarOnli.lnk
C:\WINDOWS\Start Menu\Programs\StartUp\America Online 8.0 Tray Icon.lnk
C:\WINDOWS\Start Menu\Programs\StartUp\Office Startup.lnk

========================================================================== 
__________________________________________________________________________

11. All Users Folder - (c:\windows\all users\start menu\programs\startup)

Shortcuts to any program will automatically start when placed here.

These are the shortcuts located in your All Users StartUp folder

*(No start-ups found)*

========================================================================== 
__________________________________________________________________________

12. Miscellaneous StartUp Configurations

-============================- 
Registry StartUp Directories 
-============================-

Should show the Start Menu StartUp and All Users StartUp directories

.....................................................................

[1] HKCU - Shell Folders

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

"Startup"="C:\\WINDOWS\\Start Menu\\Programs\\StartUp"

.....................................................................

[2] HKCU - User Shell Folders

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

.....................................................................

[3] HKLM - Shell Folders

HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders

"Common Startup"="C:\\WINDOWS\\All Users\\Start Menu\\Programs\\StartUp"

.....................................................................

[4] HKLM - User Shell Folders

HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\User Shell Folders

.....................................................................

-=======================- 
Registry Shell Spawning 
-=======================-

Open Commands for Executable File Types

@="\"%1\" %*"
(.exe file - RegPath = HKCR\exefile\shell\open\command)

@="\"%1\" %*"
(.com file - RegPath = HKCR\comfile\shell\open\command)

@="\"%1\" /S"
(.scr file - RegPath = HKCR\scrfile\shell\open\command)

@="\"%1\" %*"
(.bat file - RegPath = HKCR\batfile\shell\open\command)

@="\"%1\" %*"
(.pif file - RegPath = HKCR\piffile\shell\open\command)

@="C:\\WINDOWS\\SYSTEM\\MSHTA.EXE \"%1\" %*"
(.hta file - RegPath = HKCR\htafile\shell\open\command)

-=========================- 
HKLM RunOnceEx - Registry 
-=========================-

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx]

-=========================- 
HKU (.Default) Run - Registry 
-=========================-

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Run]
"Mozilla Quick Launch"="\"C:\\Program Files\\Netscape\\Netscape\\Netscp.exe\" -turbo"

-==============================- 
HKU (.Default) RunOnce - Registry 
-==============================-

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ICQ"="C:\\PROGRAM FILES\\ICQ\\ICQ.EXE -trayboot"

-================================- 
StubPaths - Registry (Partial Listing) 
-================================-

(Please see the StubPath.txt on your desktop for complete listing)

HKLM\Software\Microsoft\Active Setup\Installed Components

"StubPath"="C:\\WINDOWS\\msnmgsr1.exe"
"StubPath"="C:\\WINDOWS\\COMMAND\\sulfnbk.exe /L"
"StubPath"=""
"StubPath"="\"C:\\PROGRA~1\\OUTLOO~1\\setup50.exe\" /APP:OE /CALLER:IE50 /user /install"
"StubPath"="\"C:\\PROGRA~1\\OUTLOO~1\\setup50.exe\" /APP:WAB /CALLER:IE50 /user /install"
"StubPath"="C:\\WINDOWS\\SYSTEM\\ie4uinit.exe"
"StubPath"="C:\\WINDOWS\\SYSTEM\\updcrl.exe -e -u C:\\WINDOWS\\SYSTEM\\verisignpub1.crl"

-=================- 
WINSTART.BAT File - (c:\windows\winstart.bat) 
-=================-

@C:\WINDOWS\tmpcpyis.bat

-=================- 
WININIT.BAK File - (c:\windows\wininit.bak) 
(name) (type) (size)(modified)(time) 
wininit bak 56 01-16-03 10:09a
-=================-

[Rename]
NUL=C:\PROGRA~1\AMERIC~1.0\JITI\REAL9_~1.EXE
-=====================- 
Screen Saver Settings (Possible system.ini start-up) 
-=====================-

SCRNSAVE.EXE=C:\WINDOWS\SYSTEM\3DCHRI~1.SCR

========================================================================== 
__________________________________________________________________________

- Supplemental Environment Information -

COMSPEC=C:\WINDOWS\COMMAND.COM
PATH=C:\WINDOWS;C:\WINDOWS\COMMAND
TEMP=C:\WINDOWS\TEMP
TMP=C:\WINDOWS\TEMP
winbootdir=C:\WINDOWS
windir=C:\WINDOWS

File - c:\windows\Wininit.bak 
File - c:\windows\deletefi.ini

========================================================================== 
__________________________________________________________________________

- End -


----------



## Rollin' Rog (Dec 9, 2000)

yiksney, please do not do anything unless I have given you understandable instructions to do it. Especially in the Registry!! You could cause very serious problems if you do the wrong things there. Right click on and delete the entry you made. But don't delete anything else!

The Run folder has to be there following this path, because that is where your startups are as shown in the startup list:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

In following the file tree, make sure you don't miss anything.

I'm going to include an attachment picture of what the entry should look like in the Registry, when entered correctly. Do not include the quotes you see, the registry editor will add those

If you are not sure of what you are doing, don't do anything. You can make manual backups by running *scanregw.exe* from start>run. I would do this a few times a week at least.


----------



## yiksney (Jan 16, 2003)

did not understand to do the file tree click each command in a row 
was searching all folders anyway it just hit me to follow in order 
yipes 
all commands done it is modified and appears with the command line behind it 
it also appears in the misconfig list
what about the scan reg file i put in there idid the delete 
but it appears in the misconfig with the box unchecked 
do i need to remove from the misconfig list ?


----------



## Rollin' Rog (Dec 9, 2000)

Great!

And yes, the unchecked entry really should be removed. If it is something you placed in a startup folder look on your start menu > Programs > for an entry called "disabled startups"

Click Start
Select Programs

>> look for something called "disabled startup items"; if it is there, just right click on it and delete it.

If it is not there; follow the same File tree path in Regedit that you did before.

EXCEPT instead of selecting the RUN folder, select:

*RUN-*

this is where unchecked msconfig entries are found in the registry.

>> look in the right hand pane for that entry and right click on it and delete it.

If you are not sure, don't do anything, the unchecked entry in msconfig can't do anything as long as it remains unchecked.


----------



## yiksney (Jan 16, 2003)

ok 
yes under disabled programs scan reg was there
did right click delete
went back checked it gone 
shows only FIND FAST in disabled folder/file 
am i done ? i hope 
thanks for all your help


----------



## Rollin' Rog (Dec 9, 2000)

Yes indeed, in the immortal words of Bugs Bunny: "That's all folks!" 

Now we can put a "resolved" on this 

You're most welcome for the help.


----------



## yiksney (Jan 16, 2003)

u should run for president /
this a terrific site
wonderful help
yiksney/ going amscray
ROY ROGERS ? HAPPY TRAILS TO U UNTIL WE MEET AGAIN 

ETC


----------



## yiksney (Jan 16, 2003)

does windows me need patch from blaster worm
tried to download from msft web page 
seemed not available for ME 
IT WENT TO PAGE SAID FOUND 19 ITEMS TO INSTALL
BUT INSTALL FAILED NUMEOURS TIMES


----------



## Rollin' Rog (Dec 9, 2000)

No it doesn't. (not the best thread to ask this in, but since you asked ...


----------

