Re: [hlp] C:\WINDOWS\system32 at startup, nothing working so far

On 16 Jul 2009 19:38:26 GMT, Geof <info_huy@xxxxxxxxxxxxxxx>
spake thusly:


Do me a favor please. When you are responding below
what I write, could you hit <ENTER> once? Your text
is butted right up into mine and it is confusing. Thx! :)


Btw, you said you're running XP, right???

XP pro SP2

Okay. :)


And what brand of computer do you have?
Is it a Dell by any chance? Or is it a self built?

no not a dell, self built

Okay. :)


In the mean time, while I'm thinking about this,
have you run an Anti-Virus scan lately?

yes

Okay.


Just out of curiosity, since I don't know which
web browser you use, do you find that after
closing the folder, that it pops up again if
you run Internet Explorer?

I do not have explorer but Firefox 3.5 and
no window appears at startup only.

Okay, but what if you do run IE. Does it then
reappear? You see, if it is a spyware thing,
then it would have infected IE, not FireFox
and so the only way to determine that is by
running IE after you close the folder, to see
if the folder opens up again.


And what about just running a System Restore?
Or maybe you haven't backed up your registry
in a while and so, that wouldn't be helpful?

no recent backup

But there will be from now on, right? <lol!> :)


What Anti-Spyware apps do you run? Have
you tried a spyware scan?

*About* the same time (upgrading Ad-Aware)
this window started appearing

Okay, so maybe it's the entry for Ad-Aware.
But not likely. But anyway, go into the setup
for it and tell it not to run Ad-Watch at startup.
Unless of course, you have paid for it and
want to. :)


Also, have you installed any programs recently?
Maybe this behavior began just after you had
installed a program and you just don't remember?

My guess is: it *may* be related to the failled upgrade
(to Ad-Aware AE). I had an old 2007 edition installed
and had a error installing Ad-Aware AE. I had to use
RevoUninstaller and CCleaner to remove Ad-Aware
(and I still find traces)

Okay, what you can do, is to run a full system scan
with Ad-Aware, clean whatever it find and then
reboot and see if the problem goes away. If not,
then uninstall Ad-Aware completely, making sure
to get rid of all folders that start with "Ad-Aware",
or "Lavasoft" (assuming you have no other Lavasoft
software on your system) and then run a registry
cleaner and after that, open regedit and see if
there are entries left over for "Lavasoft".

I also would like for you to get and install the following
two programs, which are free to use and that you
should have anyway.

http://www.safer-networking.org/index2.html

http://www.superantispyware.com/

Install and run both of them, doing complete scans,
clean whatever they find and then reboot. You can
do this first, before uninstalling Ad-Aware if you want,
since it may solve the problem and it should be done
anyway. :)

I am sorry to throw all of this at you, but we have
to do the best we can to eliminate spyware as
what could be causing the problem first.

You see, I remember this happening one time
and there was an entry buried deep in the registry
and was attached to Windows Explorer and would
cause this exact problem! And a scan got it! :)


Also, you can download the following program:
http://outertech.com/index.php?_charisma_page=product&id=9

Done, installed and running, do you need to see
something in particular

Well, if you could do a screen shot, that would be nice. :)

But look for stuff that seems erroneous. Or do you see
an entry that looks empty and has maybe just a couple
of quote marks in it?

You can also easily uncheck items in this util and have
them still there and reboot and see what happens
and it give you a nice layout to view them in. :)


Also, there is an entry added sometimes by SB Audigy
cards, that will be hard to notice and it looks like this:
/l:eng
In your case, it may be /l:fr since it's a language setting.
If that's there, try unchecking that and see what happens.
nothing like this

Anything here??? Any language entries for the SB???


And lines without any quote marks, that contain strings
longer than 8 characters for a file, or folder name?

YES: in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Program Files is longer than 8 characters (as SBAudigy2ZS)

CtDvdDet as data without ""
C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE

CTSysVol as data without ""
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r

SBDrvDet.exe as data without ""
C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r

Do I have to put one " at the beginning and an other
" at the end? If so, the /r must be out of the "..." ?

*IF* they need the quotes, you would put one at
one end the other at the other end, but before
any command line switches. In other words,
for example, one before the C: and one after
the .EXE, but before the /r in the SB command line.
No spaces between the first quote and the C: and
no spaces between the .EXE and the quote mark,
but yes, a space (which is already there) between
the quote mark after the .EXE and the /r.

And so, the following:

C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r

Becomes this:

"C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe" /r

But it may *NOT* need the quote marks.

--

Pastor Dave

One of the greatest Windows utilities ever made!
A must have!!! WindowsXP/Vista/7 (32 & 64 bit)!

Single Computer: http://tinyurl.com/ldm8nz
Two Computers : http://tinyurl.com/ln5lt6

The following is part of my auto-rotating
sig file and not part of the message body.

"If you want to see what children can do, you must stop
giving them things." - Norman Douglas

.

Relevant Pages

  • Re: Websites Cant Save To Content.IE5 Folder
    ... Try undoing all changes you made and disabling all protection settings you'd enabled using Ad-aware SE Pro. ... (Most anti-malware experts recommend uninstalling/not using Webshots, Bill, and I suspect Ad-aware SE Pro is in agreement here, hence the problems.) ... >> Content.IE5 folder. ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: Internet Explorer ILLEGAL OPERATION invalid page fault in module DGNDI.DLL
    ... http://www.mytechsupport.ca/support/topic.asp?TOPIC_ID=4774 So, download the ... latest version of Ad-aware from http://www.lavasoftusa.com/software/adaware/ ... Install any available updates. ... > Internet Explorer ILLEGAL OPEARATION ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: Websites Cant Save To Content.IE5 Folder
    ... Did you scan with Ad-aware SE v1.06 and Spybot v1.4 and check for/install updates for each before doing so? ... Every time an IE site tries to download to that folder now, I receive an error similiar to this one that came ... While it did find 5 tracking cookies, removal of them did not resolve the issue. ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: HOW to DELETE XpressUpdate from CONTROL PANEL in WinXP [2]
    ... [[If you are new to Ad-Aware, we strongly recommend that you read the Help ... > SpywareBlaster is completely different than all the others on the ... Make sure of these settings and nothing will install without ...
    (microsoft.public.windowsxp.general)
  • Re: HELP!
    ... Almost every time I would run Ad-Aware, ... >>virus is probably active in memory. ... >>from the CD and let it do a complete install. ... >>connection, or the broadband modem, whichever you use, ...
    (microsoft.public.security.virus)