Author Topic: Anybody feel like helping a noob. (Read 14144 times)

levi · « **on:** October 18, 2006, 06:10:19 PM »

Ok. I'll try to explain this as best I can.
A few details, first.

OS:xp-pro
Virus protection: PC-cillan
Adaware se
Spybot search and destroy
Spyware blaster
(Note: I do have HJT, but note sure how to use it)

I have run everything(protection related)... and still can't fix the problem. Actualy...some problems were fixed. Some remain.

Last night, I was downloading something. (Not sure if I can say what it was)
Anyway.... It came with a keygen. After installing what I had downloaded, I went a head and started the keygen. That's when everything went nuts. My screen filled with popups, and I lost some normal operating features. Such as right clicking, system restore, RUN, msconfig, and a few other things. I've been trying since last night to return things to normal, but can't seem to fix everything.

Here is a strange thing. My right click feature will work if I switch to Firefox. But won't work in IE.
Also...Everything works (besides restore) if I log in as a guest.

Any ideas?

levi · « **Reply #1 on:** October 19, 2006, 03:37:39 AM »

Nobody? :-/

I'll check back when I get home from work. Thanks.

Raptor · « **Reply #2 on:** October 19, 2006, 04:53:35 AM »

Quote

Nobody? undecided

I'll check back when I get home from work. Thanks.

Quote

Today at 02:10:19

Be patient...

Quote

Here is a strange thing. My right click feature will work if I switch to Firefox. But won't work in IE.

You were using Internet Explorer to download warez? Yeah, well, what did you expect?

And why didn't you scan the keygen for viri before opening it?

If you do not understand the basics of computer security, you should not be using illegal software.

Download, install, update and run in safe mode respectively:

AVG Free
Adaware SE
Spybot S&D
Windows Defender (Genuine Windows XP only)

unlovedwarrior · « **Reply #3 on:** October 19, 2006, 08:11:37 AM »

hello and welcome

hi

first im guessing your os is xp home.. if so is it fully updated??


go here

http://www.computerhope.com/cgi-bin/yabb/YaBB.cgi?num=1134123580


dl
ewido

adaware

spybot

Ccleaner

windows defender

update them

use Ccleaner to empty your junk from temp files just open and run scan

then do full scans with ewido adaware spybot windows defender and your antivirus in safe mode (rapidly tap f8 before windows loads go to safe mode the very top one) and with system restore turned off ( right click my computer go to properties click system restore tab check box that says turn off system restore)

then reboot back into normal and report back

if you dont have a firewall already then dl zonalarm free from the site i gave

if your having pop up problems and this might be good to dl and install anyway

(for the pop up problem go here
http://www.computerhope.com/cgi-bin/yabb/YaBB.cgi?num=1147665297 )

and dl host secure


unlovedwarrior

this is a voltinteer forum so youll have to be patient but some one will come and try to help you.

if your ever going to dl any program from an untrusted site [highlight]PLEASE SCAN IT BEFORE YOU RUN IT[/highlight][/i]

levi · « **Reply #4 on:** October 20, 2006, 02:30:30 PM »

Quote

Be patient...

Sorry, dude. I thought I had given my thread enough time before I gave it a friendly bump.

Quote

You were using Internet Explorer to download warez? Yeah, well, what did you expect?
Quote

When I said I was a noob..I meant to the forum....and downloading. I'll keep the above advice in mind. Thanks. 8-)

Quote
And why didn't you scan the keygen for viri before opening it?

I did. However. PC-cillan didn't pick anything up. I assumed I was safe. Another lesson learned....I guess.

Thanks for the reply Raptor.

_______________________________________ _______________________________________ ___________

Quote
hello and welcome

hi

first im guessing your os is xp home.. if so is it fully updated??

Actually, I am running XP pro, as I sated in my original post. Sorry if I wasn't clear on that.
Yes...it's up to date.
I followed all of your instructions to no avail. Actualy...I shouldn't say that. Ewido and Ccleaner fixed a bunch of crap.
I thank you for the links.
However. All of my original problems remain.

After I finished everything you asked me to do, I ran HJT...incase it proved useful. Notice the part in bold. This is what caused everything to screw up in the first place. (I assume) It also cases a runtime 75 error. (what ever that is)
If it helps....I think I can take screen shots?

I'll post the HJT results in my next post. Thanks.

levi · « **Reply #5 on:** October 20, 2006, 02:34:03 PM »

Logfile of HijackThis v1.99.1
Scan saved at 5:06:17 PM, on 10/20/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Dell AIO 810\dlcgmon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\dlcgcoms.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\Documents and Settings\johnny\Desktop\Desktop items\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
O2 - BHO: PopThis BHO - {0549E6CB-9985-42F6-8FD6-4EC017E6AAE1} - C:\Program Files\Surfapps.com\PopThis! Free Version\PopThis.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [DLCGCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [dlcgmon.exe] "C:\Program Files\Dell AIO 810\dlcgmon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [rmalt] C:\Program Files\Systems\Nero7-Keygen.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {91663649-416A-42A5-8E54-B63C1ECA0548} - C:\Program Files\Surfapps.com\PopThis! Free Version\PopThis.dll
O9 - Extra 'Tools' menuitem: PopThis! Options... - {91663649-416A-42A5-8E54-B63C1ECA0548} - C:\Program Files\Surfapps.com\PopThis! Free Version\PopThis.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.putfile.com/includes/ImageUploader4.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: dlcg_device - - C:\WINDOWS\system32\dlcgcoms.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal F

unlovedwarrior · « **Reply #6 on:** October 20, 2006, 02:34:12 PM »

thats just a genertic post i use.... i knew u had pro.. and you did the scans in safe mode with system restore off..

im not real big on pc-cilin so i use AVG free

unlovedwarrior · « **Reply #7 on:** October 20, 2006, 02:36:06 PM »

O2 - BHO: PopThis BHO - {0549E6CB-9985-42F6-8FD6-4EC017E6AAE1} - C:\Program Files\Surfapps.com\PopThis! Free Version\PopThis.dll

did you install that??\

also have you tried just removing the file you dled?? if your almost certain its the nasty...

levi · « **Reply #8 on:** October 20, 2006, 02:42:16 PM »

I did download popthis. (never caused a problem in the past) And yes.... I found the nasty file, and deleted it. But it didn't help.

EDIT:I did everything in safe mode. But deleted the nasty file after words. Perhaps I should run the scans again?

unlovedwarrior · « **Reply #9 on:** October 20, 2006, 02:53:03 PM »

run Ccleaners issues scan to clean you register up a bit but back up the register when it asks and if you want to u can rerun the scans

also did you delete the nero 7 you dled

levi · « **Reply #10 on:** October 20, 2006, 03:09:53 PM »

Ok. I'll try that.
Yes. I deleted nero7.
Here is something I noticed. When I tried to turn on restore....my pc wouldn't let me.
Here is a screen shot. You can't see it, but it says (C) is turned off. Is that normal?

unlovedwarrior · « **Reply #11 on:** October 20, 2006, 03:21:21 PM »

is the check box checked when you first go there after u restart the computer?? or is it greyed out??

do you have a windows cd with miscrosoft all over it

levi · « **Reply #12 on:** October 20, 2006, 03:55:00 PM »

Yes....The box is always checked. I un-checked it for that screen shot.

Please don't ask about the Shiny XP disk. lol. I don't want to format...if I can help it. :-/

Here is the reason. A student friend of mine supplied me with an educational copy of XP pro. It was purchased at a local university... very cheap. It's fully functional, and legal. It comes on two disks. However...While installing XP on my old laptop (now gone in the garbage)...I left the disk in the cd tray. (stupid me) So....it's gone. I do have disk two with the serial number.....but I'm not sure if a burned copy of XP will take the legal serial.

*censored*...I didn't want to format. Any other ideas? Or am I stuck with formating?

And before I go on....I have to take a moment to thank you/this forum for you help. It is much appreciated. Since this is the first time I have ever asked for help....you can be sure that I will recommend you on all the forums I post at.

Again...Thanks.

unlovedwarrior · « **Reply #13 on:** October 20, 2006, 03:58:14 PM »

before you go and reformat wait for other members to post their thoughts. I'm no where near an expert in viruses but i do know alot. wait for fed or GX1_man or DL65. until then ill continue to try to trouble shot the problem.

unlovedwarrior · « **Reply #14 on:** October 20, 2006, 04:00:45 PM »

did you ever find out the name of the infection?? that would help.. do you have the pc-cillin setup stuff and cd with code. if so i would uninstall it and install avg free and use that see what that picks up you can get it from the site i gave earlier in this topic

levi · « **Reply #15 on:** October 20, 2006, 04:38:25 PM »

I don't know the name of the infection.
I installed and ran AVG free...which picked up a bunch of stuff, but didn't solve the problem.
I'll stay tuned for more help.

BTW. It's almost as if this problem disabled certain features in windows....Which I do not know how to fix.
Like I said....Everything works perfect in my guest account. (save restore)
But I can't right click on anything while using IE. However...Right click works fine in Fire fox.

Still....Right click doesn't work on my desktop at all. I'm stumped.

unlovedwarrior · « **Reply #16 on:** October 20, 2006, 05:44:06 PM »

have you tried to restore it to see what it does

levi · « **Reply #17 on:** October 20, 2006, 06:13:14 PM »

Restore doesn't seem to work. I get that same error...as the picture provided.
I'm stumped.

I guess a format is in my future. *censored*. [smiley=angry.gif]
Thanks for the help dude. I'll check back tommorow...incase others have an idea.

If not...I'll let ya know about the clean install. [smiley=angry.gif]

unlovedwarrior · « **Reply #18 on:** October 20, 2006, 06:15:49 PM »

k srry remember to back up ur stuff

GX1_Man · « **Reply #19 on:** October 20, 2006, 08:24:16 PM »

A format and reinstall is not necessarily a bad thing. Think of all the other problems you will correct as well.

I guess you don't need the speech about warez being laced with virii and other nasties. Download at your own risk. Protection is important but you may want to invest in an imaging program. I think you will be reloading a lot.

JPH · « **Reply #20 on:** October 20, 2006, 09:07:12 PM »

Hi levi,

GX1_Man is right, a format and reinstall is not a bad thing and it will fix any other problems that you might have. However, if reinstalling Windows simply isn't an option for you....

Copy and paste this into notepad and save it as fix.reg

Code: [Select]

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoRun"=dword:00000000
"NoViewContextMenu"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
"DisableConfig"=dword:00000000
"DisableSR"=dword:00000000

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions]
"NoBrowserContextMenu"=dword:00000000

Next double click this new reg file to import this information into the registry.
After the info has been successfully imported you will need to reboot for the settings to take effect.

This should fix the Run prompt, Right-Click and System Restore issues you're having. As for MSConfig not working I need you to better clarify what you mean since it appears to be present and in the correct path. Also please rename HiJackThis.exe to HJT2K6.exe and then post a new and complete HJT log.

- JPH

unlovedwarrior · « **Reply #21 on:** October 20, 2006, 11:21:24 PM »

see told u

patio · « **Reply #22 on:** October 21, 2006, 05:38:52 PM »

A legal version of XP does NOT come on 2 CD's...

GX1_Man · « **Reply #23 on:** October 21, 2006, 07:24:10 PM »

Warez on top of warez. And he wonders why he has problems.

I think the moment that machine gets legitimate software on it all of these problems would be history.

levi · « **Reply #24 on:** October 22, 2006, 09:02:55 AM »

Sorry I took so long getting back. It's been a crazy weekend.

Anyway. Thanks for the reply, JPH. I'm about to try your method right now.

Quote

A legal version of XP does NOT come on 2 CD's...

My version of XP is legal. But there are shades of grey in there. lol. As I already mentioned, it's a educational copy. It does come on two disks, but it's not for resale...anywhere. You can only purchase it at the school. And you have to be a registered student to buy it. I think it cost around $18 US. And like I said....I lost disk one. Which has the entire OS on it. Disk two has tutorials and a bunch of other crap.
Geez..... Why would I come to a forum asking for help, then try to deceive any of you? I'm not built that way. And yes...I have learned my lesson when it comes to warez. I'm not going to mess with stuff that I don't understand.

Anyway. Let's try to fix my PC. lol.

OH...Here is a picture of disk two. Sorry about the quality. I couldn't be arsed to take another. But I will if you need further proof.

levi · « **Reply #25 on:** October 22, 2006, 09:17:52 AM »

Quote

Hi levi,

GX1_Man is right, a format and reinstall is not a bad thing and it will fix any other problems that you might have. However, if reinstalling Windows simply isn't an option for you....

Copy and paste this into notepad and save it as fix.reg

Code: [Select]
Windows Registry Editor Version 5.00 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoRun"=dword:00000000 "NoViewContextMenu"=dword:00000000 [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore] "DisableConfig"=dword:00000000 "DisableSR"=dword:00000000 [HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions] "NoBrowserContextMenu"=dword:00000000
Next double click this new reg file to import this information into the registry.
After the info has been successfully imported you will need to reboot for the settings to take effect.

This should fix the Run prompt, Right-Click and System Restore issues you're having. As for MSConfig not working I need you to better clarify what you mean since it appears to be present and in the correct path. Also please rename HiJackThis.exe to HJT2K6.exe and then post a new and complete HJT log.

- JPH

I followed your instructions. I copied the info to notepad. I saved it as fix.reg
I then double clicked it. The notepad file opened, but didn't seem to do anything. Am I missing something. Or is supposed to do that until I reboot? Sorry for being lame. I'm really new to this, and trying to learn from you.
Thanks in advance. [smiley=cool.gif]

PS. Msconfig problem: When I go to Run, type msconfig, I get an error. Windows can not find msconfig. That never happened before.

levi · « **Reply #26 on:** October 22, 2006, 09:36:45 AM »

Updated HJT log.
I re-named the .exe file as you instructed.

Logfile of HijackThis v1.99.1
Scan saved at 12:34:14 PM, on 10/22/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe
C:\Documents and Settings\johnny\Desktop\Desktop items\hijackthis\HJT2K6.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: dlcg_device - - C:\WINDOWS\system32\dlcgcoms.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

JPH · « **Reply #27 on:** October 22, 2006, 03:27:15 PM »

You say that when you go to Run and type msconfig you get an error. I was under the impression that you lost the RUN prompt? Well either way applying the NoRun fix won't hurt anything. About the reg file, it sounds like it is still a txt file. You probably have Windows set to hide file extensions for known file types, which means it's probably actually named fix.reg.txt. You can open any folder and go to Tools > Folder Options > View and UNcheck "Hide extensions for known file types" then click Apply. Then you can make sure it is actually named fix.reg it should look like this if reg files are correctly associated:

Here is an updated version that will also fix MSConfig if it is still present in the correct path:

Code: [Select]

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoRun"=dword:00000000
"NoViewContextMenu"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
"DisableConfig"=dword:00000000
"DisableSR"=dword:00000000

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions]
"NoBrowserContextMenu"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MSCONFIG.EXE]
@="C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\MSConfig.exe"

I will also attach a copy of the reg file to this post in case you don't feel like messing with the hide extensions setting. Just unzip the reg file to the desktop and either double-click it or right click it and choose Merge. Then after it has been imported successfully, reboot.

Your HJT log looks clean.

- JPH

patio · « **Reply #28 on:** October 22, 2006, 04:04:46 PM »

And no matter what pictures you post that is not an XP CD...

chriscool9 · « **Reply #29 on:** October 22, 2006, 04:14:08 PM »

Quote

And no matter what pictures you post that is not an XP CD...

He did say it was an educational copy...
Maybe thats how they come? But yea i see what you mean, they usually come on one disk...

Chris

Raptor · « **Reply #30 on:** October 22, 2006, 04:49:09 PM »

It's probably Windows XP on one CD and SP 1 or 2 on CD 2.. I have that as well, except that mine are copies. So we 'll never know I suppose.

Ah well, I can live with that.

levi · « **Reply #31 on:** October 22, 2006, 05:18:12 PM »

Quote

You say that when you go to Run and type msconfig you get an error. I was under the impression that you lost the RUN prompt? Well either way applying the NoRun fix won't hurt anything. About the reg file, it sounds like it is still a txt file. You probably have Windows set to hide file extensions for known file types, which means it's probably actually named fix.reg.txt. You can open any folder and go to Tools > Folder Options > View and UNcheck "Hide extensions for known file types" then click Apply. Then you can make sure it is actually named fix.reg it should look like this if reg files are correctly associated:

Here is an updated version that will also fix MSConfig if it is still present in the correct path:

Code: [Select]
Windows Registry Editor Version 5.00 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoRun"=dword:00000000 "NoViewContextMenu"=dword:00000000 [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore] "DisableConfig"=dword:00000000 "DisableSR"=dword:00000000 [HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions] "NoBrowserContextMenu"=dword:00000000 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MSCONFIG.EXE] @="C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\MSConfig.exe"
I will also attach a copy of the reg file to this post in case you don't feel like messing with the hide extensions setting. Just unzip the reg file to the desktop and either double-click it or right click it and choose Merge. Then after it has been imported successfully, reboot.

Your HJT log looks clean.

- JPH

Well....Some things have returned to normal since the begining of this thread. Like the "Run" prompt. It's there, but can't find msconfig. I assume that some things were fixed while running all the cleaners provided by the kind members here at CHF.

Quote

it sounds like it is still a txt file

Yes it is. And no matter what I do....I can't change it.

Quote

You probably have Windows set to hide file extensions for known file types

No. I thought of that. But my folder options aren't set up that way. And... the zip file you provided extracts as a text file too.
I'm stumped, I tells ya.

And Patio. It is a legal copy of XP pro. I'm not sure what else I can do to prove it, so I won't bother. Actualy...I'll go one step further to prove it. And that's only because you are trying to make me out to be liar. Here's what ya do. Send an email to MEEC Enterprise.
(Maryland Education Enterprise Consortium)
Ask them if they sell XP pro to their students, for campus use only. Ask them how much they charge for the disks, how many disks are supplied, and what they look like. If ya don't want to do that...I'll take Levi FTW!!! lol I'm kidding dude. Still...You check it out for your peace of mind.

JPH · « **Reply #32 on:** October 22, 2006, 05:49:11 PM »

Can you open regedit?

patio · « **Reply #33 on:** October 22, 2006, 06:12:16 PM »

By no means was i trying to make you out a liar...far from it.
If you knew how many issues we have stumbled through here with people who are not legit you would understand my trepidation...

As to your listed copy of XP i'm glad it is what you say it is. I cannot keep track of every University issued copy of XP and remember what they in fact look like...

Any offense taken comes with my apologies.

Carry on.

patio. 8-)

levi · « **Reply #34 on:** October 22, 2006, 06:17:19 PM »

Quote

Can you open regedit?

Yes. regedit opened fine from the run prompt. What should I do with it?

Patio: [smiley=beer.gif]

JPH · « **Reply #35 on:** October 22, 2006, 06:28:46 PM »

OK, open regedit and go to File > Import
Change the "Files of Type" to "All Files" then scroll to the reg file I attached earlier and open it. It should still import anyway even if it's a txt file as long as all the text is still there. If it says it successfully imported then reboot and see if msconfig, right-click etc. is working.

levi · « **Reply #36 on:** October 22, 2006, 06:40:11 PM »

Well....You F'n rock dude.

Everything has returned to normal. Thanks sooooooo much for your help. And to think....I was so close to giving up.
Again...thank you so much. You really know your stuff. And... thanks to the other members, kind enough to give me a hand.
Oh...incase you can't tell...I'm doing a happy dance.

JPH · « **Reply #37 on:** October 22, 2006, 06:56:05 PM »

Great! You're welcome Levi.

I'm glad things are back to normal now.
Your reg file associations are still messed up though if they are still showing as txt files.
Let me know if that is the case and we'll fix that too.

- JPH

levi · « **Reply #38 on:** October 22, 2006, 07:01:06 PM »

Hmm. Yeah, they are still showing as txt files.

JPH · « **Reply #39 on:** October 22, 2006, 07:07:09 PM »

OK, I've attached a fix. Just import it the same way you did the last one.

unlovedwarrior · « **Reply #40 on:** October 22, 2006, 10:57:52 PM »

JPH where did you learn this stuff??

JPH · « **Reply #41 on:** October 22, 2006, 11:23:11 PM »

Quote

JPH where did you learn this stuff??

--> www.vmodeling.com

levi · « **Reply #42 on:** October 23, 2006, 04:22:52 AM »

Quote

OK, I've attached a fix. Just import it the same way you did the last one.

Awesome dude.....You did it. Thanks again, mang. You rock. [smiley=beer.gif]

unlovedwarrior · « **Reply #43 on:** October 23, 2006, 08:23:11 AM »

Quote

Quote
JPH where did you learn this stuff??
--> www.vmodeling.com

lol

JPH · « **Reply #44 on:** October 23, 2006, 02:39:40 PM »

Quote

Awesome dude.....You did it. Thanks again, mang. You rock. [smiley=beer.gif]

Great, you're welcome.

Now that you're back to normal you might want to set a new system restore point. [smiley=beer.gif]

@unlovedwarrior: [smiley=grin.gif]

Computer Hope Forum

News:

Author Topic: Anybody feel like helping a noob. (Read 14144 times)

levi

levi

Raptor

unlovedwarrior

levi

levi

unlovedwarrior

unlovedwarrior

levi

unlovedwarrior

levi

unlovedwarrior

levi

unlovedwarrior

unlovedwarrior

levi

unlovedwarrior

levi

unlovedwarrior

GX1_Man

JPH

unlovedwarrior

patio

GX1_Man

levi

levi

levi

JPH

patio

chriscool9

Raptor

levi

JPH

patio

levi

JPH

levi

JPH

levi

JPH

unlovedwarrior

JPH

levi

unlovedwarrior

JPH