Upper Lower Filters in XP Registry

[Neal Lavon]

Since Windows 2000 is fairly close to XP, I thought I would ask...I
believe my Upper and Lower Filters values in the key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}
is corrupted because my CD-ROM is recognized by the system but cannot
play any CDs or show any data. By the way, the values read:
Upper Filters: REG_SZ InCDPass GEARAspiWDM Cdralw2k pwd_2k
There is also a .bak value: InCDPass GEARAspiWDM

The Lower Filter is: PXHelp20 PFC Cdr4_xp
There is also a .bak value of PXHelp20 PFC

I'm a little leery of deleting these keys (as advised) but can someone
tell me how relatively safe or not these particular values are and
what danger exists in hosing the registry? I do have a backup.

Thanks for any help.

Neal Lavon
Takoma Park, MD
USA

 

[John John]

You want to be careful deleting some of these CD writer keys, it could
render your system unbootable. Read here for possible solutions:

http://search.microsoft.com/search/...\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}

The reason you can't read your cd's might be because an associated Nero
service doesn't start. Look in the Services Manager to change or start
the necessary service(s).

A note about InCD:

"This is the InCD software which enables you to drag files onto a CD-R
directly from Windows Explorer, or to save onto CD directly from within
applications like Microsoft Word, without using the CD Recording
software that came with your CD-Writer (Nero). While a great and
potentially very useful concept, the limitations of InCD CDs (CDs
created with InCD are only ever guaranteed to be readable in CD Writers
that are the same model as the CD Writer in which the CD was created –
it is not unusual not to be able to read a CD created via InCD, in
another CD-ROM drive) lead us to always recommend its removal. We
advocate to instead always use its sister product, Nero (also called
"Nero Burning ROM"), to create CDs, as that is the only method that
guarantees that you will be able to read the CDs you create in any other
CD, CD-Writer, or DVD drive – a crucial consideration if you are using
CDs for data backups !

Recommendation :
Unless you do make use of InCD, remove it via "Add/Remove Programs" in
the Control Panel. Otherwise right-click on it in the System Tray and
temporarily disable it whenever you need to use other software that will
want to write to your CD Writer."

http://www.answersthatwork.com/

These CD/DVD writer software packages can cause havoc on your system.
As for InCD I would follow the advice offered by answersthatwork.

John

 

[Dave Patrick]

This article may help.

http://support.microsoft.com/kb/314060/EN-US/

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| Since Windows 2000 is fairly close to XP, I thought I would ask...I
| believe my Upper and Lower Filters values in the key:
|
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}
| is corrupted because my CD-ROM is recognized by the system but cannot
| play any CDs or show any data. By the way, the values read:
| Upper Filters: REG_SZ InCDPass GEARAspiWDM Cdralw2k pwd_2k
| There is also a .bak value: InCDPass GEARAspiWDM
|
| The Lower Filter is: PXHelp20 PFC Cdr4_xp
| There is also a .bak value of PXHelp20 PFC
|
| I'm a little leery of deleting these keys (as advised) but can someone
| tell me how relatively safe or not these particular values are and
| what danger exists in hosing the registry? I do have a backup.
|
| Thanks for any help.
|
| Neal Lavon
| Takoma Park, MD
| USA

 

[nlavon]

Gosh, thanks for this advice. I really was queasy last night attempting
this for fear I'd hose the system.

I'll check out the Services Manager and delete the damned thing.

Neal Lavon
Takoma Park, MD
USA

 

[abram]

PXHelp20 is a faulty driver. You may want to try deleting it first.

 

[Jim Byrd]

Hi Neal - Try using this reg file to handle the delete (it takes care of
deleting some other things which can cause problems as well):
http://forum.aumha.org/ http://www.aumha.org/downloads/cdgone.zip This is
pretty much the "standard" fix for this type of issue. Backup first so that
you can recover if there are problems (there aren't usually, BTW).

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

 

[Neal Lavon]

Jim, do I replace the CD-ROM default Microsoft Driver? One poster said
I might have a corrupted driver. I do have a fresh copy of
CDr4_xp.sys. Before reboot after when system searches for driver for
CD-ROM?

Thanks!

Neal Lavon
Takoma Park, MD
USA

 

[Jim Byrd]

Hi Neal - If you're sure that you have a "clean" copy of the driver, I would
replace it first, then reboot and see if that fixes the problem. If not,
you can then run the .reg fix. You may have difficulty replacing it because
it's an "in use" system file; if so, you can use one of the programs below
to do that for you.

I don't currently happen to have a copy of XP installed, but I believe that
that's not a protected file (my version - cdr4_2k.sys - doesn't appear to be
in my current Win2kProSP4), so you should only have to replace it in
%SystemRoot%\System32\Drivers folder I think, but check the
System32\dllcache folder and the ServicePackFiles folders also just to be
sure, and if it's there replace it in those locations also.

From one of my "standard" cleaning-up-malware posts:

"A program called Copylock, here,
http://noeld.com/programs.asp?cat=misc#CopyLock can aid in the process of
"replacing, moving, renaming or deleting one or many files which are
currently in use (e.g. system files like comctl32.dll, or virus/trojan
files.)" Another is Killbox, here:
http://www.downloads.subratam.org/KillBox.zip
A third which is a bit different but often useful is Delete Invalid File,
here: http://www.purgeie.com/delinv.htm which handles invalid/UNC
file/folder name deleting, rather than the in use problem."


--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

 

[Neal Lavon]

Thanks, Jim. Just one last item before I take your advice! For Driver
Details on my non-functioning CD-ROM, I see a series of driver files
in Device Manager/Driver File Details:

They are all in c:\WINDOWS\system32\drivers folder:
Cdr4_xp.sys
Cdralw2k.sys
cdrom.sys
GEARAspiWDM.sys
imapi.sys
InCDPass.sys
pfc.sys
pwd_2k.sys
PxHelp20.sys
redbook.sys
storprop.sys

There are green checks next to the redbook, storprop, imapi and
cdrom.sys files.So is the cdrom.sys the magic file here if I can get
that one? Also PxHelp20.sys may be fault; I did get a new version of
that one.

I did not see a dllcache folder but the cdrom.sys file is in my
Service Pack/i386 folder.

Is the easiest thing just to run the .reg file?
BTW, the InCD file is something that Nero Burning ROM must have
installed...grrr. Cdralw2k is from Adaptec which makes Easy CD Creator
7, the burn program I have,

Thanks for all your help.

Neal Lavon
Takoma Park, MD
USA

 

[Jim Byrd]

Hi Neal - Ah, new data!

If you have both InCD and Easy CD Creator's Drag to Disk DirectCD, their
respective drivers are known to confict badly with each other. These are
two fundamentally different approaches to packet writing to your RW CD/DVD.
You should try to uninstall one or the other (I would suggest the InCD, as
IIRC it's easiest - use Add/Remove Programs in the Control Panel).

You might also want to disable XP's built-in CDWriter if you consistently
use Easy CD Creator or Nero by preference. There have been some reports of
conflicts here also. To stop it, go to Administrative Tools|Services. In
Services, double click on (IIRC I think it's) Imapi cd burning then
Stop and then Disable.

Reboot after each removal/disable, then run the .reg file fix and reboot. I
would suggest that you try this first before replacing the driver, contrary
to what we last discussed.

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

 

[Neal Lavon]

Jim, still no luck with the system reading the CD despite applying the
remedy:


Latest data in4D36E965-E325-11CE-BFC1-08002BE10318:
Default REG-SZ DVD/CD-ROM drives
Class REG-SZ CDROM
EnumPropPages32 REG-SZ MmSys.Cpl,MediaPropPageProvider
Icon REG-SZ -51
Installer32 REG-SZ stroprop.dll, DvdClassInstaller
LowerFilters.bak REG_MULTI_SZ PxHelpl 20 PFC
NoInstallClass REG-SZ 1
SilentInstall REG-SZ 1
TroubleShooter-0 REG-SZ hcp://help/tshoot/tsdrive.htm
UpperFilters.Bak REG_MULTI-SZ InCDPass GEARAspiWDM

In Device Manager for CD-ROM:
C:\WINDOWS\system32\DRIVERS\cdrom.sys
C:\WINDOWS\system32\DRIVERS\imapi.sys
C:\WINDOWS\system32\DRIVERS\redbook.sys
C:\WINDOWS\system32\DRIVERS\storprop.dll

Since there was a registry key regarding InCD, a search revealed:
INCD43111.EXE-384C5EAB.pf in the C:\Windows\Preftech

So that's about it. What loads at startup is Norton files, McAfee tray
programs and P2P networking. Any further help or advice would be
greatly appreciated!

Neal Lavon
Takoma Park, MD
USA

 

[Jim Byrd]

Hi Neal - Tell me exactly what you did on this last round. Did you
uninstall InCD? Did you disable CDWriter? Did you run the .reg fix? etc.
BTW, I would kill all of my Norton/Symantec stuff on startup until you get
this straightened out (or better yet, permanantly ) Norton is
notorious for interfering with other programs.

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

 

[Neal Lavon]

First of all, Jim, I really appreciate your keeping with this. Thank
you very much.

I uninstalled InCD and rebooted. I then disabled CD Writer in
Administrative Services and rebooted, then I merged the downloaded reg
file and rebooted. Still didn't work. Although in the past couple of
days, I've gotten small bits of activity like a CD icon spinning next
to the mouse arrow or the title CD Rom under the icon, but only for a
little bit.

Anyway, I also deleted the CD in Device Manager and rebooted but to no
avail.

So that's where I am. I just wonder about the PX20 help file
referenced in the Registry key under LowerFilters.bak. Just real
frustrating. Let me know what you think, and again, thank you for your
time and attention.

Neal Lavon
Takoma Park, MD
USA

 

[Jim Byrd]

Hi Neal - First - sorry to be so long getting back to this - stuff going on.

Re-boot your computer and then look in Event Viewer and report back any
error or informational messages listed there after the "starting Event
Viewer" message in detail.


Take a look at Add-Remove Programs and see if you show a separate entry for
the Roxio (used to be Adaptec) DirectCD - not quite sure how it will be
listed, so look for various alternative listings for it. If so uninstall it
and re-boot, run the cdgone.reg file again, and then re-boot again. (While
you're there, be sure there's no longer any listing for InCD. You should
still have a Nero listing of some sort, however - just no InCD.)

If you don't find a separate listing for DirectCD, you may need to try
uninstalling Nero and/or Easy CD Creator 5 or 6 or whatever successively.
Be sure you have the necessary installation media available for each of
these for re-installation before proceding with any uninstall.

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

 

[Neal Lavon]

Hey, Jim, nice to hear from you again. I'll try what you say, no
problem and report back.

Neal Lavon

 

[Neal Lavon]

OK, now we may be getting somewhere. I went into Event Viewer and
found both warnings and errors for the CD-ROM in the system log.

The warning was:

Product: Windows Operating System
ID: 51
Source: Cdrom
Version: 5.2
Symbolic Name: IO_WARNING_PAGING_FAILURE
Message: An error was detected on device %1 during a paging operation.

Explanation
An input/output (I/O) request to a memory-mapped file failed and the
operation was retried.

The error message was:

Product: Windows Operating System
ID: 11
Source: Cdrom
Version: 5.2
Symbolic Name: IO_ERR_CONTROLLER_ERROR
Message: The driver detected a controller error on %1.

Explanation
This problem is typically caused by a failing cable that connects the
drive to the computer.


User Action
Replace the cable.

So, I guess this means that the cable connecting the DVD to the CD and
then to the motherboard is faulty? I think I used a newer 80-ribbon
cable. Sounds like I should go out and get another cable. I'd like to
stick with 80.

Neal Lavon
Takoma Park, MD
USA

 

[Jim Byrd]

Hi Neal - Well, I'd certainly try reseating the cables on BOTH ends first,
taking a VERY careful look for bent pins, etc. on the components. It's very
easy for a connector to get partially pulled out of the component's socket,
also. It can be awkward to get into and hard to see, so be sure to have
good bright light locally available when you look. If no joy there, then
replacing the cables may be in order, but I'd make a good visual inspection
first.

How are you cabled up? Do you have both CD/MVP's on one cable, one master
and one slave or Cable Select? or one on each of your IDE channels and, if
so, as Masters or Slaves, or what. Have you made any physical change in
your setup near coincident in time with your problem that thus might account
for it? How you're cabled up and how the dipswitches/jumpers on the
components are set (M, S, CS) can have significant impacts on their
operation, particularly if not compatible with each other. A "typical"
setup that works in most cases is to set the components as Slaves on their
jumpers and then cable them as the slave components, one each of your HD
channels (If you have two HD's). This is usually the end connector on the
cable (the Master is usually the middle one.) If that doesn't apply, you'll
need to make appropriate adjustments if things aren't set right. Note that
on some machines I've found in the past that the CS approach doesn't always
work and specifically selecting for M or S may be needed for proper
operation. Read any available documentation CAREFULLY.

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

 

[Neal Lavon]

Jim--thanks for getting back promptly.

When my son and I put in the new CD, we kept the slave jumper on the
new CD just as it was configured when it came out of the box. We
rehooked everything back up the way it originally was, but then I
started having trouble seeing the drive. The CD is hooked up as a
slave to the Plextor 708A DVD drive master.

The two optical drives are attached on one IDE cable going to the
motherboard. I have two hard drives also hooked as master and slave
going to the other IDE channel on the motherboard.

What we did with the optical drives was cable the middle connector on
the drive to the slave CD and the top connector to the master DVD. If
that's the case (and I think it is), we can try reversing the IDE
cable connections to each drive. I do believe the slave and master
settings on the drives are okay as that's the way they had worked
before.

Right now, the master drive sits in the top of the computer with the
slave drive below it. Changing the cable connection with the middle
connector going to the master and the top connector to the slave
indicates it would be a lot easier just to swap the drives out and
reconnect with the CD slave on the top and the DVD master in the
middle, keeping the jumpers the same. That certainly is an option. Or
I suppose one could reverse the jumpers and make the DVD the slave and
the CD the master, although the Plextor guide seems to say it should
be the master which I think is probably the better way to go.

In fact, now that I recall, that is the way I had them before the new
system was configured to XP and the drives reversed. Hmmmm. I think
you may have hit the jackpot here. At least in theory, this sounds
like it could be the problem.

The documentation never says anything about which cable connection
should go to master or slave, it just mentions hooking them up unless
I really missed it (which is possible).

Wow, could that be it? I'll have to try that. That seems to be the
logical conclusion of what you're suggesting.

That seems to make sense to me. What do you think?

Neal Lavon
Takoma Park, MD
USA

 

[Jim Byrd]

Hi Neal - If you've wired and jumpered as you say, then you may well have a
conflict. I'd just switch the middle and end connectors (moving the drives
if needed for convenience) if your documentation recommends that the one you
currently have jumpered as Slave should be that way - some drives cannot
support being a master. For right now see if that fixes things for you.
[Later you might want to do some reading on the net about alternative
configurations such as having each HD be master and each CD/DVD drive be
slave. Do a Google on this for more info - it's thought by some experts to
have some advantages. Let's see if re-connecting the drives cleans things
up first though. Then you can look at things like that and doing such
things as enabling DMA for your CD/DVD drives (which is a whole other thing
) ] Please let us know what happens.

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

 

[Neal Lavon]

Grrr.

Jim, I just changed not only my configuration but used two CD-ROM
drives with nothing, although there was some progress. I did re-cable
the CD-ROM as a slave using the top IDE connector of a new ribbon
cable. The DVD-ROM drive is now below it in the computer case. When I
first booted up with the Liteon, nothing.

I replaced the Liteon with another ATAPI CD-ROM I have and when that
booted up, I noticed that the little icon for a spinning CD appeared
briefly by the mouse and seemed to "want" to load but in the end, did
not. I still got the same error message in Event Viewer.

For what it's worth, here's the data in the box below the error
message:

0000: 03 04 68 00 01 00 b8 00 ..h...¸.
0008: 00 00 00 00 0b 00 04 c0 .......À
0010: 01 01 00 00 85 01 00 c0 ....?..À
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 80 00 00 00 00 00 00 .?......
0028: 3f 69 00 00 00 00 00 00 ?i......
0030: ff ff ff ff 00 00 00 00 ÿÿÿÿ....
0038: 40 00 00 c4 02 00 01 00 @..Ä....
0040: ff 20 0a 12 4c 02 00 00 ÿ ..L...
0048: 00 08 00 00 0a 00 00 00 ........
0050: 00 00 c7 85 90 eb b4 86 ..Ç? [square box] ë´?
0058: 00 00 00 00 f8 8b ef 86 ....ø?ï?
0060: 00 60 f7 86 10 00 00 00 .`÷?....
0068: 28 00 00 00 00 10 00 00 (.......
0070: 01 00 00 00 00 00 00 00 ........
0078: 70 00 04 00 00 00 00 0a p.......
0080: 00 00 00 00 08 00 00 00 ........
0088: 00 00 00 00 00 00 00 00 ........

Also on Driver File Details in Device Driver:

C:\\WINDOWS\system32\drivers\Cdr4_xp.sys
C:\\WINDOWS\system32\driversCdral2k.sys
C:\\WINDOWS\system32\drivers\cdrom.sys
C:\\WINDOWS\system32\drivers\imapi.sys
C:\\WINDOWS\system32\drivers\pwd_2k.sys
C:\\WINDOWS\system32\drivers\redbook.sys
C:\\WINDOWS\system32\drivers\strorprop.dll

In the Registry Key, 4D36E965-E325-11CE...
LowerFilters is REG_MULTI_SZ Cdr4_xp
UpperFilters REG_MULTI_SZ Cdralw2k pwd_2k
LowerFilters.Bak REG_MULTI_SZ PxHelp20 PFC
UpperFilters.Bak REG_MULTI_SZ InCDPass GEARAspiWDM

There is no trace of Nero software (Ahead Company) (InCD left) in
Add/Remove Programs. So I'm really stumped and frustrated.

Questions:

a) someone in a thread here said that the PxHelp20 PFC file is
corrupted. I have seen that it's a Trojan Virus and keeps CD-ROMs from
working properly. It is in the Drivers file. How does one "disable"
it? Just remove it from the Drivers File?

b) delete in the Registry the Upper and Lower Filters.Bak files? Run
cdgone.reg again?

I think I'm nearing a possible solution here. Thanks!

Neal Lavon
Takoma Park, MD
USA

Hi Neal - If you've wired and jumpered as you say, then you may well have a
conflict. I'd just switch the middle and end connectors (moving the drives
if needed for convenience) if your documentation recommends that the one you
currently have jumpered as Slave should be that way - some drives cannot
support being a master. For right now see if that fixes things for you.
[Later you might want to do some reading on the net about alternative
configurations such as having each HD be master and each CD/DVD drive be
slave. Do a Google on this for more info - it's thought by some experts to
have some advantages. Let's see if re-connecting the drives cleans things
up first though. Then you can look at things like that and doing such
things as enabling DMA for your CD/DVD drives (which is a whole other thing
) ] Please let us know what happens.