archive files not accessible

[Donn]

After running AVAST free edition it told me that an archive file in
C:\RESTORE\Archive... was not accessible. Seeing that it wasn't a restore\temp I wasn't worried, but just for safety sake I ran a trojan scan--clean of course. What are archive\rstore files?

:confused:

[Paul Komski]

http://forums.spywareinfo.com/index.php?showtopic=13481

[Donn]

Yeah, I know that, but I'm just wondering why I have archive\restore files...for what? The last time I had a bug I disabled the Sysyem Restore, so what could be there? And why, what are they for? :confused:

[Paul Komski]

Unless I'm missing something these are the WinME restore folders. Perhaps system restore is actually turned on or wasn't purged previously. I think these folders are never empty in any case although when system restore is "turned off" they just contain header or meta information rather than the full whack.

[Donn]

Ok, so I disabled/re-enabled the system restore. Now it doesn't function. When I went to the system restore page, it is blank white. I checked to see if the disable box was checked and it is NOT checked, I have run AVAST--clean, trojan scan--clean.

And perhaps coincidentally I cannot get into Earthlink or MSN e-mail, The sign-in page either doesn't come up, or there is no box to put in the e-mail name and password. And when I click on emoticons on this site--they don't show.

Any ideas?

[Paul Komski]

How are you for disk space, see Virtualme's post at http://forums.techguy.org/archive/index.php/t-208827.html

Otherwise it sounds like some malware or registry corruption.

[Donn]

Hi Paul--

According to Belarc I have 27.97 GB of space free out of 40 GB total. I did the qfecheck for the post 2001 update of system restore (upd290700)--ok there.

I checked this morning after booting up, and did another disable/re-enable of system restore, and the page is still blank white with the system restore border.

Also I do not have a Win Me disk, I am assuming that it did not come with the pc since it was OEM and already installed, bought it 'open box' at a discount. I am still not able to make emoticons appear on this site anymore, although I hear the 'tick' through the speakers when I click on one.....

Anybody? Any ideas?

Edit: Avast and Adaware both clear.

[Paul Komski]

You could try scanreg /restore (http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/Q221/5/12.ASP&NoWebContent=1) or dig deeper for malware by using HJT I guess.

[malcore]

I am still not able to make emoticons appear on this site anymore

Do you possibly have Active Scripting turned off in IE's security options?

Can you still make a smilie by typing it in manually, colon : followed by right bracket ) ? :)

[Donn]

I did the scanreg /restore, and it indicated it was successful; the date--August 1, 2004, had 'started' next to it. I checked the system restore--it's till blank-white with the system restore border.

I just checked--Active scripting is enabled. Here goes the colon and the brackett....:)


I just clicked on the 'cool' emoticon, it clicked in my speakers and made a little dotted box around the face in the menu to the left, but it isn't placing it....frown-face

Edit: well it seems the colon and brackett worked, but clicking on the faces in the menu does not. I am going to go check my radio stations--Jazzfm.com, and kkcr.org and see if that works colonrightbracket. :)

2nd edit: KKCR site came in, but when I clicked on the 'listen live' icon (Real Player) nothing happened--repeatedly. jazzradio.net, when I clicked on the 'listen live' icon (win media player) it gave me an error box: "An internal appplication error has occurred" yellow triangle with a ! in it. but the station came on, when I clicked away the error box, the station went with it. Tried it twice, same result. Jazzfm.com, Real Player, no problems.


confused

[Paul Komski]

If you click on the check message length link at the bottom of a post - do you get a dialog box giving you the answer?

[Donn]

Check message length, I clicked it waited a while, didn't see anything, clicked it again, clciks in the speakers, nothing new appeared so far...

Edit: Windows mMedia Player will not open--same "Internal Application error has ocurred" eror box, and with any station that uses it exclusively.

2nd Edit: Control Panel is blank


HJT log, just in case:

Logfile of HijackThis v1.98.1
Scan saved at 4:44:49 PM, on 8/4/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
C:\PROGRAM FILES\SYGATE\SPF\SMC.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\CPQEADM.EXE
C:\WINDOWS\SYSTEM\HIDSERV.EXE
C:\COMPAQ\CPQINET\CPQINET.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\BTTNSERV.EXE
C:\PROGRAM FILES\COMPAQ\DIGITAL DASHBOARD\DEVGULP.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\LXAMSP32.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\EAUSBKBD.EXE
C:\PROGRAM FILES\MOTIVE\MOTMON.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXE
C:\PROGRAM FILES\EARTHLINK TOTALACCESS\TASKPANL.EXE
C:\PROGRAM FILES\MRU-BLASTER\SCHEDULER.EXE
C:\PROGRAM FILES\COMPAQ KNOWLEDGE CENTER\BIN\MAD.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\MY DOCUMENTS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.earthlink.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie/button/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.earthlink.net/partner/more/msie/button/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.pcguide.com/vb
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.presario.net/scripts/redirectors/presario/srchredir.dll?c=3c00&s=search&LC=0409
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.presario.net/scripts/redirectors/presario/srchredir.dll?c=3c00&s=searchbar&LC=0409
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.earthlink.net/AL/Search
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: EarthLink Popup Blocker - {4B5F2E08-6F39-479a-B547-B2026E4C7EDF} - C:\Program Files\EarthLink TotalAccess\PnEL.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: EarthLink Toolbar - {D7F30B62-8269-41AF-9539-B2697FA7D77E} - C:\Program Files\EarthLink TotalAccess\PnEL.dll
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Hidserv] Hidserv.exe run
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\cpqeadm.exe
O4 - HKLM\..\Run: [EACLEAN] C:\Program Files\Compaq\Easy Access Button Support\eaclean.exe
O4 - HKLM\..\Run: [CPQInet] c:\compaq\CPQInet\CpqInet.exe
O4 - HKLM\..\Run: [Digital Dashboard] C:Program Files\Compaq\Digital Dashboard\DevGulp.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [lxamsp32.exe] lxamsp32.exe
O4 - HKLM\..\Run: [LexmarkPrinTray] PrinTray.exe
O4 - HKLM\..\Run: [Ad-aware] "C:\PROGRAM FILES\LAVASOFT\AD-AWARE 6\AD-AWARE.EXE" +c
O4 - HKLM\..\Run: [ScriptSentry] C:\PROGRAM FILES\SCRIPT SENTRY\SCRIPTSENTRY.exe /check
O4 - HKLM\..\Run: [MotiveMonitor] C:\Program Files\Motive\motmon.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\AVAST4\ashmaisv.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\SYGATE\SPF\SMC.EXE -startgui
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [avast!] C:\Program Files\Alwil Software\Avast4\ashServ.exe
O4 - HKLM\..\RunServices: [SmcService] C:\PROGRAM FILES\SYGATE\SPF\SMC.EXE
O4 - HKLM\..\RunOnce: [MRUBlaster] C:\PROGRAM FILES\MRU-BLASTER\indexcleaner.exe -CACHE
O4 - HKCU\..\Run: [E6TaskPanel] "C:\PROGRAM FILES\EARTHLINK TOTALACCESS\TASKPANL.EXE" -winstart
O4 - Startup: COMPAQ KNOWLEDGE CENTER.LNK = C:\Program Files\Compaq Knowledge Center\bin\silent.exe
O4 - Startup: MRU-Blaster Scheduler.lnk = C:\Program Files\MRU-Blaster\scheduler.exe
O4 - Startup: MRU-Blaster Silent Clean.lnk = C:\Program Files\MRU-Blaster\mrublaster.exe
O8 - Extra context menu item: Check &Spelling - res://C:\PROGRAM FILES\IESPELL\IESPELL.DLL/SPELLCHECK.HTM
O8 - Extra context menu item: &ieSpell Options - res://C:\PROGRAM FILES\IESPELL\IESPELL.DLL/SPELLOPTION.HTM
O9 - Extra button: Translate - {06FE5D05-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirectors/presario/srchredir.dll?s=avbabelfish&c=3c00&LC=0409 (file missing)
O9 - Extra 'Tools' menuitem: AV &Translate - {06FE5D05-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirectors/presario/srchredir.dll?s=avbabelfish&c=3c00&LC=0409 (file missing)
O9 - Extra button: (no name) - {06FE5D02-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirectors/presario/srchredir.dll?s=avlinksearch&c=3c00&LC=0409 (file missing)
O9 - Extra 'Tools' menuitem: &Find Pages Linking to this URL - {06FE5D02-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirectors/presario/srchredir.dll?s=avlinksearch&c=3c00&LC=0409 (file missing)
O9 - Extra button: (no name) - {06FE5D03-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirectors/presario/srchredir.dll?s=avhostsearch&c=3c00&LC=0409 (file missing)
O9 - Extra 'Tools' menuitem: Find Other Pages on this &Host - {06FE5D03-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirectors/presario/srchredir.dll?s=avhostsearch&c=3c00&LC=0409 (file missing)
O9 - Extra button: (no name) - {06FE5D04-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirectors/presario/srchredir.dll?s=altavista&c=3c00&LC=0409 (file missing)
O9 - Extra 'Tools' menuitem: AV Live - {06FE5D04-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirectors/presario/srchredir.dll?s=altavista&c=3c00&LC=0409 (file missing)
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - res://C:\PROGRAM FILES\IESPELL\IESPELL.DLL/SPELLCHECK.HTM (file missing)
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - res://C:\PROGRAM FILES\IESPELL\IESPELL.DLL/SPELLCHECK.HTM (file missing)
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - res://C:\PROGRAM FILES\IESPELL\IESPELL.DLL/SPELLOPTION.HTM (file missing)
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - res://C:\PROGRAM FILES\IESPELL\IESPELL.DLL/SPELLOPTION.HTM (file missing)
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab

clicked 'check message length'...I don't see anything new anywhere...

[Paul Komski]

I'll leave HJT to those who specialise in it. Javascript seems to be inactive in your browser - you can also check it out at http://www.bodo.com/javame.htm

To the emoticons and the above site work in another browser?

[Donn]

Paul, I check out on the java-active site, at both tests I could read the messages.

I ran scan disk and it says something is writing ot the disk, but I went into 'close programs' before I ran scan disk and closed everything except systray and explorer. I tried to defrag it anyway but it wouldn't get passed 'checking disk for errors.'

I also went back to scanreg /restore and tried for an earlier date. it said the restore took, but Control panel is blank and system restore is blank, and when I booted back up the active desk top was turned off, and I had to customize it to bring it back.


frown-face

[Paul Komski]

Control Panel, Help, and System Restore Are Empty or Partially Empty
http://support.microsoft.com/default.aspx?kbid=309663

[Donn]

Paul, thanks. I went to the reg and found the keys mentioned in the article, but mine is not exactly the same. The knowledge base says the file should read:

HKEY_CLASSES_ROOT\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

but mine does not have \Inprocserver32 on the end although the previous sequence is the same. Is that not the right key to modify then? None of the keys the article indicates (in my reg) have that "InprocServer32"
on the end. My default says "J Script Language".

[Paul Komski]

Many of the HKLM\CLSID\{xxxxxxxx-xxxx-xxxx-xxxxxxxxxxxx} keys should have an InprocServer32 subkey (did you expnd that CLSID value properly and, btw, in my own registry that CLSID has three other subkeys called Implemented Categories, OLEScript and ProgID).

If the InProcServer32 subkey doesn't exist for that key I would create it and then add the two values for the (Default) and ThreadingModel String values. Repeat for the HKLM\SOFTWARE\CLASSES\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb558}\InprocServer32 subkey.

You can always delete the subkeys later if you want to get back to where you are now. The "JScript Language ... " default value for that actual CLSID sounds correct.

If you want you can use the attached txt file to create/edit these two values in both sub-keys for you; just change the file extension to .reg and double click on the file.

Of course none of this answers the question of how your registry became corrupted in the first place.

[Paul Komski]

Forgot the attachment.

[Paul Komski]

Sorry there was an error in the last inproc.txt file; this inproccorrected.txt one should be OK

[Donn]

Hi Paul:

I got the InprocServer32 subkey, but it has three listings:

Default "C:\Program Files\ALWIL\Software\Avast4\A..."


Default Engine "C\Windows\System\JScript.DLL"

Threading Model "Both"


Now, it is interesting to see AVAST there in Default because this whole thing started after I uninstalled AVAST free to go back to AVG free--I just like the AVG control panel better, plus you can schedule AVG. Then I went to my email to get the license key for AVG download, and suddenly reralized I would be on the net without an AV. Then I noticed I had no sign in page for hotmail, and a quick check of Earthlink showed there was no sign-in boxes on their sign-in page, then the rest of it....

Whaddaya think? If I change the Default to C:\Windows....Script.DLL, then to what do I change the Default engine? The Microsoft article doesn't mention a 'default engine'.

The score card so far:

System restore page --blank white, blank-white in safe mode
Control panel -- blank white, but shows ok & operates ok in Safe Mode.
Adaptec software does not respond (not checked in Safe Mode)
Printer does not respond (haven't had a chance to check in safe mode)
1 yahoo e-mail account is useable but not all functions--delete does not work, but I can send and receive in it.
Av and anti-spyware all report clean.

The good side is, I guess, I don't have a cat spitting up hairballs on the keyboard. :)?

Edit: corrections

[Paul Komski]

I would be inclined to edit them to have two key values as per the MSKB. You could always make a backup first by exporting the values to your hdd.

Hard to know why how or what Avast is doing in there.

[Donn]

What exactly do I do to export it to the hd? I have never done that before.

[Paul Komski]

In the left pane, highlight the key you wish to backup.
On the File Menu choose export.
Choose a File Name and Location.
Select which Export Range you want; if just the highlighted key above was chosen it should show up there by default.
Choosing "All" would backup the whole Registry.
Hit Save.

RClick the Saved File and choose Edit to see/edit its contents.
To put the values back in the Registry either just double click the saved file or RClick and choose Merge.

Some keys will require a reboot to take effect - others will work straight away.

;)

One general note is that Win2K/XP save these text files in Unicode. If one wants to ever export a "cross platform key" from Win2K/XP then ensure that the header is "REGEDIT4" and not "Windows Registry Editor Version 5.00" and that the file is re-saved using "Save As" and ensuring that the Encoding of the Notepad Text file is ANSI and not Unicode. This wont apply in this instance. Only files with the "REGEDIT4" header and in ANSI text format can be merged into both Win9X/ME and Win2K/XP.

[Donn]

Ok Paul, thanks, I did a dry run on it to see if everything in there checks with what you said, and it does--this is a strange Win Me, it just doesn't match up to so many other things that I've seen written about Win Me OSes. So I'm checking everything twice, like we say in building: measure it twice, cut it once.

I also got an email off to AVAST and explained the situation, gave them this thread, and asked them if they know of any simialr situations, and if those reg keys should have AVAST in them. So, I am goign to wait and see wht they say--which i cannot do until I get itme to go to the library and read my e-mail. I can get my default e-mail account to send out by clicking on any email address in any website, and then either sending it to their site, or re-addressing it to another. . .

. . .all this, and, thank Odin, no cats to spit-up hairballs on my keyboard. If things got any better I'd be giddy.

[Donn]

Ok Paul, thanks, I did a dry run on it to see if everything in there checks with what you said, and it does--this is a strange Win Me, it just doesn't match up to so many other things that I've seen written about Win Me OSes. So I'm checking everything twice, like we say in building: measure it twice, cut it once.

I also got an email off to AVAST and explained the situation, gave them this thread, and asked them if they know of any simialr situations, and if those reg keys should have AVAST in them. So, I am going to wait and see what they say--which I cannot do until I get itme to go to the library and read my e-mail. I can get my default e-mail account to send out by clicking on any email address in any website, and then either sending it to their site, or re-addressing it to another. . . I'll post what (if) they reply.

. . .all this, and, thank Odin, no cats to spit-up hairballs on my keyboard. If things got any better I'd be giddy.

[Donn]

Originally posted by Paul Komski
Control Panel, Help, and System Restore Are Empty or Partially Empty
http://support.microsoft.com/default.aspx?kbid=309663

Ok, I figured out a way to get the license code from AVG through the one e-mail accoutn I can access in yahoo. No problem, installed. Then I uninstalled AVAST and went to the reg to change the entries mentioned in the above URL from the MKDB. No problem.

Problem: both reg keys are no longer there:

HKEY_CLASSES_ROOT\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}

HKEY_CLASSES_ROOT.....558}

neither one, and the problems still exist, blank control panel, system restore, etc.

So, what can I do to get those two keys back? (God, please let them not say--download AVAST again....)

[Donn]

Originally posted by Donn


Ok, I figured out a way to get the license code from AVG through the one e-mail accoutn I can access in yahoo. No problem, installed. Then I uninstalled AVAST and went to the reg to change the entries mentioned in the above URL from the MKDB. No problem.

Problem: both reg keys are no longer there:

HKEY_CLASSES_ROOT\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}

HKEY_CLASSES_ROOT.....558}

neither one, and the problems still exist, blank control panel, system restore, etc.

So, what can I do to get those two keys back? (God, please let them not say--download AVAST again....)


Ok, I did a reg restore and got the first key back:
HKEY_CLASSES_ROOT\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}

but the second key:
HKEY_CLASSES_ROOT\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb558}

is not there.

All ideas, particularly ones that work, will be greatly appreciated.


OKAY, PROBLEM SOLVED, EMAIL OK, RADIO STATIONS OK, CONTROL PANEL IN ALL ITS BLAZING GLORY, SYSTEM RESTORE--ALL FLAGS FLYING. emoticons :D

The second key mentioned in that MKDB article is still not there, perhaps that's the 'default engine?' Whatever, I'm back at 100%.

Paul...owe you one :cool: any thoughts on that second key?

[Paul Komski]

Create the key yourself manually - or use the inproccorrected.txt file (renamed with a .reg extension) that I uploaded earlier to merge the two values for you.

PS the two keys you just posted look identical - I guess that's a typo ??

[Donn]

Originally posted by Paul Komski
Create the key yourself manually - or use the inproccorrected.txt file (renamed with a .reg extension) that I uploaded earlier to merge the two values for you.

Y'know. it's running ok, so i am affraid I'll mess it up, but I might do it anyway, just to be adventurous. There is also an error in your 2ndinproccorrected file, you write the file out with two\\ marks between the extensions: C:\WINDOWS\\SYSTEM\\....Does that matter, I guess I should ask...?

[i]PS the two keys you just posted look identical - I guess that's a typo ?? [/B]

the first one ends in bbbb58, the second one in bbbb558

Now, when you said earlier:

"If you want you can use the attached txt file to create/edit these two values in both sub-keys for you; just change the file extension to .reg and double click on the file."

Are you saying add .reg to exactly where? after the bbbb58 on the registry, or after the C:\windows...JScript on your downloaded inproccorrected.text ? or after the corrected entry in the registry under default C:\windows...JScript

Paul, be specific, remember, you're dealing with an idiot. (bring it, Frus, I can take it...)

[Paul Komski]

The second key ending 558 is an invalid format. All clsids must take the format 8-4-4-4-12 {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}

The double // is correct for the .reg file itself as is the @ sign for the default value but these would be written correctly (with a single / etc) in the registry itself.

Changing the file extension is just that - a changed file extension. A file called abcd.txt could be renamed abcd.reg (or even xyz.reg for that matter). Just RClick on the file in MyComputer and choose rename; then agree to the warning about changing file extensions. Double click the file (now called ****.reg) or RClick on it and choose Merge. Agree to the warning once again.

That's about it I think. :D

[Donn]

Originally posted by Paul Komski
The second key ending 558 is an invalid format. All clsids must take the format 8-4-4-4-12 {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}


Ok, I have to ask... then why does the MSKDB list that file like that:


"Browse to the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{f414c26 0-6ac0-11cf-b6d1-00aa00bbbb558}\InprocServer32

Repeat steps 3 and 4 to edit this key. "

There it is big as life...."HKEY_LOCAL....bbbb558" I am of the conviction that if it ain't broke don't fix it. So I am going to leave it alone for now anyway. :D

[Paul Komski]

Believe it or not "Hawkeye" I'm sure that is a MS typo.

In my own machine none of the HKLM\SOFTWARE\Classes\CLSID values are of a different format than the norm and the
[HKLM\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32] values are:-
(Default) C:\WINDOWS\System32\jscript.dll
ThreadingModel Both

[Donn]

Originally posted by Paul Komski
Believe it or not "Hawkeye" I'm sure that is a MS typo.

In my own machine none of the HKLM\SOFTWARE\Classes\CLSID values are of a different format than the norm and the
[HKLM\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32] values are:-
(Default) C:\WINDOWS\System32\jscript.dll
ThreadingModel Both


Right, but see a complete understudy type like m'self with bare minimum experience in the registry...that doesn't ocurr to me. What ocurrs to me is they say browse to Key HKLM....bbbb58 and do such-and-such, then browse to Key HKLM...bbbb558 and do such and such, and I just start looking for it. But it's an interesting lesson that I can take into the future. :) Meanwhile, if that is a typo, what was it supposed to be. Is there someother reg key I have to change? If not, one has to ask....what's it doing there?

Meanwhile my AVG driver files wouldn't load so I had to uninstall/ re-instal AVG-6, and low and behold when I went to Add/Remove AVAST was still there. When I tried to uninstall it, it said there was no file to refer to....??? So I uninstalled AVG and went back to Add/Remove and AVAST was not listed anymore.

So, does anyone know of a tool to deep clean AVAST out of the system. I already ran Reg Seeker (very cool tool, thanks PrntRhd), on it, but if there is a deep cleaning tool for AVAST I'm want to use it. AVAST did not respond to me e-mails.

(edit: errors)

[Paul Komski]

The two registry keys referred to by the MSKB use the same CLSID (disregaring the CLSID typo) but are two different keys at two different locations:
HKEY_CLASSES_ROOT\CLSID\
and
HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\

Don't understand the problems with avast/avg install/uninstall. I have never had problems with either anti-virus and just wonder if you shouldn't be considering a clean install.

[Donn]

Originally posted by Paul Komski
The two registry keys referred to by the MSKB use the same CLSID (disregaring the CLSID typo) but are two different keys at two different locations:
HKEY_CLASSES_ROOT\CLSID\
and
HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\

Don't understand the problems with avast/avg install/uninstall. I have never had problems with either anti-virus and just wonder if you shouldn't be considering a clean install.


Oh, how embarrassing, you are right, I just copied them wrong in the first place. . .better go and check this other one....

Edit: (wrong key before)Okay, it's set right, I was looking at the key below it ...f414c261 inistead of f414c260

AVG seems to be running ok since I re-installed it. This Win Me just is not stable, it jumps all over the place like this every so often. Either that, or, as FTT and Jabar will be quick to point out--I am, in fact, cursed.

[Donn]

Paul what do you have at
HKEY_LOCAL MACHINE_SOFTWARE_CLASSES_CLSID_f414c261...bbbb58

under 'implimeted categories'? "No Value set" ?

[Paul Komski]

Implemented Categories (Default) value:-
..261.. has (Value not set) as does ...260...

Both have subkeys with other CLSID values that themselves all have a (Default) Value of (Value not set)

[Donn]

Okay, thanks, I'm lookin good here, and decided to get Nod32 for a free trial ( a month I think). Thanks again.