autoexec.nt deletion

[lambros]

IN SEVERALL CASES AFTER CLEANING COMPUTER , A MESSAGE FOR
REBOOT NEED IS DISPLAYED.AT THIS POINT YOU CAN SEE
A "LARGE" IT'S NOW SAFE TO TURN YOUR COMPUTER MESSAGE!!
AFTER RESTART LOOK UP AT C:\WINNT\SYSTEM32 FOR AUTOEXEC.NT
BECAUSE AT CLEANING PROCEDURE OFTEN IS BEEING DELETED!!
IF YOU HAVE A COPY OF THIS FILE PASTE INTO THE CERTAIN
DIRECTORY & YOU WILL NOT HAVE PROBLEMS.TO UNDERSTAND IF
YOU HAVE THIS PROBLEM LOOK OUT FOR MESSAGES "WINDOWS CAN
NOT WORK AT 16bit SUBSYSTEM OR SOMETHING LIKE THAT WITH
APPLICATIONS.
AS FOR SECURITY FORGET IT BECAUSE MALICIOUS SOFTWARE STILL
INSTALLED PASSING THROUGH SHIELD!!! (INVALID INSTALLATION
MESAAGES DURING STBY MODE!!!
HEEEEEEEEEEELP!!!!!!!!!!!!

 

[Steve Dodson [MSFT]]

I do not understand the issue you are running into. Can you clarify the
issue without using all caps?

-steve


Steve Dodson [MSFT]
MCSE, CISSP
PSS Security

--

This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Note: For the benefit of the community-at-large, all responses to this
message are best directed to the newsgroup/thread from which they
originated.
--------------------

 

[lambros]

dear steve ,sorry for caps
in a win2k sp4 system (notebook) after using software a
reboot option apears.if you do this 16 bit subsystem is
destroyed by deleted autoexec.nt
now if you have a copy of the file it's ok if you don't ??
also ist toolbal side bar & other .exe files at c:\winnt
folder do not removed and keep regenerating them selfs.
so its endless procedure without performing anything!!

-----Original Message-----
I do not understand the issue you are running into. Can you clarify the
issue without using all caps?

-steve


Steve Dodson [MSFT]
MCSE, CISSP
PSS Security

--

This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Note: For the benefit of the community-at-large, all responses to this
message are best directed to the newsgroup/thread from which they
originated.
--------------------

Content-Class: urn:content-classes:message
From: "lambros" <[email protected]>
Sender: "lambros" <[email protected]>
Subject: autoexec.nt deletion
Date: Thu, 27 Jan 2005 01:19:53 -0800
Lines: 14
Message-ID: <[email protected]>
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Newsreader: Microsoft CDO for Windows 2000
thread-index: AcUEUVxq6zGUfJ/VTPCeOCJ40reTDg==
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300
Newsgroups: microsoft.private.security.spyware.networking
Path: cpmsftngxa10.phx.gbl
Xref: cpmsftngxa10.phx.gbl microsoft.private.security.spyware.networking:447
NNTP-Posting-Host: tk2msftngxa13.phx.gbl 10.40.1.165
X-Tomcat-NG: microsoft.private.security.spyware.networking

IN SEVERALL CASES AFTER CLEANING COMPUTER , A MESSAGE FOR
REBOOT NEED IS DISPLAYED.AT THIS POINT YOU CAN SEE
A "LARGE" IT'S NOW SAFE TO TURN YOUR COMPUTER MESSAGE!!
AFTER RESTART LOOK UP AT C:\WINNT\SYSTEM32 FOR AUTOEXEC.NT
BECAUSE AT CLEANING PROCEDURE OFTEN IS BEEING DELETED!!
IF YOU HAVE A COPY OF THIS FILE PASTE INTO THE CERTAIN
DIRECTORY & YOU WILL NOT HAVE PROBLEMS.TO UNDERSTAND IF
YOU HAVE THIS PROBLEM LOOK OUT FOR MESSAGES "WINDOWS CAN
NOT WORK AT 16bit SUBSYSTEM OR SOMETHING LIKE THAT WITH
APPLICATIONS.
AS FOR SECURITY FORGET IT BECAUSE MALICIOUS SOFTWARE STILL
INSTALLED PASSING THROUGH SHIELD!!! (INVALID INSTALLATION
MESAAGES DURING STBY MODE!!!
HEEEEEEEEEEELP!!!!!!!!!!!!

.

 

[Bob]

After I installed the MS anti-spyware on four computers,
two of them get thie following message on reboot - "16
bit Windows Subsystem C:\windows\system32\autoexec.nt The
file system is not suitable for runnin MS Dos and
Microsoft Window applications

The file was not in that directory, but I located it
elsewhere on the computer and put it back in the system32
folder - still get he message on reboot. All are MS XP
one with SP2 and the others without.

Its like something is tring to load on startup that needs
the file and can't find it - but its there now. Even got
the meesage on one computer when inserting a cdrom with
printer drivers. Any suggestions?

-----Original Message-----
dear steve ,sorry for caps
in a win2k sp4 system (notebook) after using software a
reboot option apears.if you do this 16 bit subsystem is
destroyed by deleted autoexec.nt
now if you have a copy of the file it's ok if you don't ??
also ist toolbal side bar & other .exe files at c:\winnt
folder do not removed and keep regenerating them selfs.
so its endless procedure without performing anything!!

-----Original Message-----
I do not understand the issue you are running into. Can you clarify the
issue without using all caps?

-steve


Steve Dodson [MSFT]
MCSE, CISSP
PSS Security

and
confers no rights.

Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Note: For the benefit of the community-at-large, all responses to this
message are best directed to the newsgroup/thread from which they
originated.

.

 

[Jim Byrd]

Hi Bob - Try this fix, courtesy of MVP Kelly Theiriot:


"This installaton program will reinstall the missing or corrupt Windows XP
system files command.com, autoexec.nt and config.nt. The absence or
corruption of one or more of these files causes a "16 Bit Subsystem" error.

XP_Fix.EXE by TRF Systems, Inc.
http://www.visualtour.com/downloads/xp_fix.exe

More info here:

Error Message: MS-DOS or 16-bit Windows-based program
http://www.kellys-korner-xp.com/xp_m.htm#16bit"


Then, courtesy of flrman1, here:
http://forums.techguy.org/archive/index.php/t-280212.html

"First in safe mode click on My Computer then click Tools > Folder Options.
In Folder options click on the View tab. Under Files and Folders tick "Show
hidden files and folders" then uncheck "Hide file extensions for known file
types" and uncheck "Hide protected operating system files (recommended)".
Now click "Like current folder" then "Apply" and "OK"

Now find and delete these files:

C:\WINNT\system\windupdate.exe (added by JB: note the spelling - the
added 'd')
C:\WINNT\system.css

Delete this folder:

c:\freescan

Also in safe mode navigate to the C:\Windows\Temp folder. Open the Temp
folder and go to Edit > Select All then Edit > Delete to delete the entire
contents of the Temp folder.

Go to Start > Run and type %temp% in the Run box. The Temp folder will open.
Click Edit > Select All then Edit > Delete to delete the entire contents of
the Temp folder.

Finally go to Control Panel > Internet Options. On the General tab under
"Temporary Internet Files" Click "Delete Files". Put a check by "Delete
Offline Content" and click OK. Click on the Programs tab then click the
"Reset Web Settings" button. Click Apply then OK.


Empty the Recycle Bin"


Run the fix file again after you're done w/the above.

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

After I installed the MS anti-spyware on four computers,
two of them get thie following message on reboot - "16
bit Windows Subsystem C:\windows\system32\autoexec.nt The
file system is not suitable for runnin MS Dos and
Microsoft Window applications

The file was not in that directory, but I located it
elsewhere on the computer and put it back in the system32
folder - still get he message on reboot. All are MS XP
one with SP2 and the others without.

Its like something is tring to load on startup that needs
the file and can't find it - but its there now. Even got
the meesage on one computer when inserting a cdrom with
printer drivers. Any suggestions?

-----Original Message-----
dear steve ,sorry for caps
in a win2k sp4 system (notebook) after using software a
reboot option apears.if you do this 16 bit subsystem is
destroyed by deleted autoexec.nt
now if you have a copy of the file it's ok if you don't ??
also ist toolbal side bar & other .exe files at c:\winnt
folder do not removed and keep regenerating them selfs.
so its endless procedure without performing anything!!

-----Original Message-----
I do not understand the issue you are running into. Can you clarify
the issue without using all caps?

-steve


Steve Dodson [MSFT]
MCSE, CISSP
PSS Security

--

This posting is provided "AS IS" with no warranties, and confers no
rights. Use of included script samples are subject to the terms
specified at http://www.microsoft.com/info/cpyright.htm

Note: For the benefit of the community-at-large, all responses to
this message are best directed to the newsgroup/thread from which
they originated.
--------------------
Content-Class: urn:content-classes:message
From: "lambros" <[email protected]>
Sender: "lambros" <[email protected]>
Subject: autoexec.nt deletion
Date: Thu, 27 Jan 2005 01:19:53 -0800
Lines: 14
Message-ID: <[email protected]>
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Newsreader: Microsoft CDO for Windows 2000
thread-index: AcUEUVxq6zGUfJ/VTPCeOCJ40reTDg==
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300
Newsgroups: microsoft.private.security.spyware.networking
Path: cpmsftngxa10.phx.gbl
Xref: cpmsftngxa10.phx.gbl
microsoft.private.security.spyware.networking:447
NNTP-Posting-Host: tk2msftngxa13.phx.gbl 10.40.1.165
X-Tomcat-NG: microsoft.private.security.spyware.networking

IN SEVERALL CASES AFTER CLEANING COMPUTER , A MESSAGE FOR
REBOOT NEED IS DISPLAYED.AT THIS POINT YOU CAN SEE
A "LARGE" IT'S NOW SAFE TO TURN YOUR COMPUTER MESSAGE!!
AFTER RESTART LOOK UP AT C:\WINNT\SYSTEM32 FOR AUTOEXEC.NT
BECAUSE AT CLEANING PROCEDURE OFTEN IS BEEING DELETED!!
IF YOU HAVE A COPY OF THIS FILE PASTE INTO THE CERTAIN
DIRECTORY & YOU WILL NOT HAVE PROBLEMS.TO UNDERSTAND IF
YOU HAVE THIS PROBLEM LOOK OUT FOR MESSAGES "WINDOWS CAN
NOT WORK AT 16bit SUBSYSTEM OR SOMETHING LIKE THAT WITH
APPLICATIONS.
AS FOR SECURITY FORGET IT BECAUSE MALICIOUS SOFTWARE STILL
INSTALLED PASSING THROUGH SHIELD!!! (INVALID INSTALLATION
MESAAGES DURING STBY MODE!!!
HEEEEEEEEEEELP!!!!!!!!!!!!


.

.

 

[Bob]

Thanks Jim. I might give that a try, though I found on
another MS info page:
http://support.microsoft.com/default.aspx?scid=kb;en-
us;324767

Where it says I can just replace those three files by
running an expand command for them from the CDrom. But
that was written before SP2 came out and I wasn't sure if
those files would be okay to reinstall since I have put
SP2 on the computer.

Though I think you may have found at least part of the
root cause. Just about everytime I run the beta spyware
scan it finds that windupdate.exe file you mentioned. It
keeps saying it has deleted it, but it keeps showing up.
I wonder it that is going to keep corrupting those three
files after I replace them if it keeps coming back. I
wish these anti-spyware programs would simply stop this
stuff from getting put on the comnputer rather than
having to go find and remove them every time you fnish
going on the internet. Thanks for your help.

Bob

-----Original Message-----
Hi Bob - Try this fix, courtesy of MVP Kelly Theiriot:


"This installaton program will reinstall the missing or corrupt Windows XP
system files command.com, autoexec.nt and config.nt. The absence or
corruption of one or more of these files causes a "16 Bit Subsystem" error.

XP_Fix.EXE by TRF Systems, Inc.
http://www.visualtour.com/downloads/xp_fix.exe

More info here:

Error Message: MS-DOS or 16-bit Windows-based program
http://www.kellys-korner-xp.com/xp_m.htm#16bit"


Then, courtesy of flrman1, here:
http://forums.techguy.org/archive/index.php/t-280212.html

"First in safe mode click on My Computer then click Tools > Folder Options.
In Folder options click on the View tab. Under Files and Folders tick "Show
hidden files and folders" then uncheck "Hide file extensions for known file
types" and uncheck "Hide protected operating system files (recommended)".
Now click "Like current folder" then "Apply" and "OK"

Now find and delete these files:

C:\WINNT\system\windupdate.exe (added by JB: note the spelling - the
added 'd')
C:\WINNT\system.css

Delete this folder:

c:\freescan

Also in safe mode navigate to the C:\Windows\Temp folder. Open the Temp
folder and go to Edit > Select All then Edit > Delete to delete the entire
contents of the Temp folder.

Go to Start > Run and type %temp% in the Run box. The Temp folder will open.
Click Edit > Select All then Edit > Delete to delete the entire contents of
the Temp folder.

Finally go to Control Panel > Internet Options. On the General tab under
"Temporary Internet Files" Click "Delete Files". Put a check by "Delete
Offline Content" and click OK. Click on the Programs tab then click the
"Reset Web Settings" button. Click Apply then OK.


Empty the Recycle Bin"


Run the fix file again after you're done w/the above.

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

After I installed the MS anti-spyware on four computers,
two of them get thie following message on reboot - "16
bit Windows Subsystem C:\windows\system32\autoexec.nt The
file system is not suitable for runnin MS Dos and
Microsoft Window applications

The file was not in that directory, but I located it
elsewhere on the computer and put it back in the system32
folder - still get he message on reboot. All are MS XP
one with SP2 and the others without.

Its like something is tring to load on startup that needs
the file and can't find it - but its there now. Even got
the meesage on one computer when inserting a cdrom with
printer drivers. Any suggestions?

-----Original Message-----
dear steve ,sorry for caps
in a win2k sp4 system (notebook) after using software a
reboot option apears.if you do this 16 bit subsystem is
destroyed by deleted autoexec.nt
now if you have a copy of the file it's ok if you don't ??
also ist toolbal side bar & other .exe files at c:\winnt
folder do not removed and keep regenerating them selfs.
so its endless procedure without performing anything!!
-----Original Message-----
I do not understand the issue you are running into. Can you clarify
the issue without using all caps?

-steve


Steve Dodson [MSFT]
MCSE, CISSP
PSS Security

--

This posting is provided "AS IS" with no warranties, and confers no
rights. Use of included script samples are subject to the terms
specified at http://www.microsoft.com/info/cpyright.htm

Note: For the benefit of the community-at-large, all responses to
this message are best directed to the newsgroup/thread from which
they originated.
--------------------
Content-Class: urn:content-classes:message
From: "lambros" <[email protected]>
Sender: "lambros" <[email protected]>
Subject: autoexec.nt deletion
Date: Thu, 27 Jan 2005 01:19:53 -0800
Lines: 14
Message-ID: <[email protected]>
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Newsreader: Microsoft CDO for Windows 2000
thread-index: AcUEUVxq6zGUfJ/VTPCeOCJ40reTDg==
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300
Newsgroups: microsoft.private.security.spyware.networking
Path: cpmsftngxa10.phx.gbl
Xref: cpmsftngxa10.phx.gbl
microsoft.private.security.spyware.networking:447
NNTP-Posting-Host: tk2msftngxa13.phx.gbl 10.40.1.165
X-Tomcat-NG:
microsoft.private.security.spyware.networking

IN SEVERALL CASES AFTER CLEANING COMPUTER , A MESSAGE FOR
REBOOT NEED IS DISPLAYED.AT THIS POINT YOU CAN SEE
A "LARGE" IT'S NOW SAFE TO TURN YOUR COMPUTER MESSAGE!!
AFTER RESTART LOOK UP AT C:\WINNT\SYSTEM32 FOR AUTOEXEC.NT
BECAUSE AT CLEANING PROCEDURE OFTEN IS BEEING DELETED!!
IF YOU HAVE A COPY OF THIS FILE PASTE INTO THE CERTAIN
DIRECTORY & YOU WILL NOT HAVE PROBLEMS.TO UNDERSTAND IF
YOU HAVE THIS PROBLEM LOOK OUT FOR MESSAGES "WINDOWS CAN
NOT WORK AT 16bit SUBSYSTEM OR SOMETHING LIKE THAT WITH
APPLICATIONS.
AS FOR SECURITY FORGET IT BECAUSE MALICIOUS SOFTWARE STILL
INSTALLED PASSING THROUGH SHIELD!!! (INVALID INSTALLATION
MESAAGES DURING STBY MODE!!!
HEEEEEEEEEEELP!!!!!!!!!!!!


.

.

.

 

[Jim Byrd]

Hi Bob - Yes, that file is the proximate cause of the problem (at least for
some cases). You need to delete all the things in flrman1's fix as I posted
previously. Also, you might try running the Beta Spyware program _twice_
while in _Safe_ mode (or from a Clean Boot) after doing those
deletions. As to prevention measures, you might want to take a look at my
Blog about this here for some steps you might take:
http://defendingyourmachine.blogspot.com/

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

Thanks Jim. I might give that a try, though I found on
another MS info page:
http://support.microsoft.com/default.aspx?scid=kb;en-
us;324767

Where it says I can just replace those three files by
running an expand command for them from the CDrom. But
that was written before SP2 came out and I wasn't sure if
those files would be okay to reinstall since I have put
SP2 on the computer.

Though I think you may have found at least part of the
root cause. Just about everytime I run the beta spyware
scan it finds that windupdate.exe file you mentioned. It
keeps saying it has deleted it, but it keeps showing up.
I wonder it that is going to keep corrupting those three
files after I replace them if it keeps coming back. I
wish these anti-spyware programs would simply stop this
stuff from getting put on the comnputer rather than
having to go find and remove them every time you fnish
going on the internet. Thanks for your help.

Bob

-----Original Message-----
Hi Bob - Try this fix, courtesy of MVP Kelly Theiriot:


"This installaton program will reinstall the missing or corrupt
Windows XP system files command.com, autoexec.nt and config.nt. The
absence or corruption of one or more of these files causes a "16 Bit
Subsystem" error.

XP_Fix.EXE by TRF Systems, Inc.
http://www.visualtour.com/downloads/xp_fix.exe

More info here:

Error Message: MS-DOS or 16-bit Windows-based program
http://www.kellys-korner-xp.com/xp_m.htm#16bit"


Then, courtesy of flrman1, here:
http://forums.techguy.org/archive/index.php/t-280212.html

"First in safe mode click on My Computer then click Tools > Folder
Options. In Folder options click on the View tab. Under Files and
Folders tick "Show hidden files and folders" then uncheck "Hide file
extensions for known file types" and uncheck "Hide protected
operating system files (recommended)". Now click "Like current
folder" then "Apply" and "OK"

Now find and delete these files:

C:\WINNT\system\windupdate.exe (added by JB: note the spelling
- the added 'd')
C:\WINNT\system.css

Delete this folder:

c:\freescan

Also in safe mode navigate to the C:\Windows\Temp folder. Open the
Temp folder and go to Edit > Select All then Edit > Delete to delete
the entire contents of the Temp folder.

Go to Start > Run and type %temp% in the Run box. The Temp folder
will open. Click Edit > Select All then Edit > Delete to delete the
entire contents of the Temp folder.

Finally go to Control Panel > Internet Options. On the General tab
under "Temporary Internet Files" Click "Delete Files". Put a check
by "Delete Offline Content" and click OK. Click on the Programs tab
then click the "Reset Web Settings" button. Click Apply then OK.


Empty the Recycle Bin"


Run the fix file again after you're done w/the above.

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

After I installed the MS anti-spyware on four computers,
two of them get thie following message on reboot - "16
bit Windows Subsystem C:\windows\system32\autoexec.nt The
file system is not suitable for runnin MS Dos and
Microsoft Window applications

The file was not in that directory, but I located it
elsewhere on the computer and put it back in the system32
folder - still get he message on reboot. All are MS XP
one with SP2 and the others without.

Its like something is tring to load on startup that needs
the file and can't find it - but its there now. Even got
the meesage on one computer when inserting a cdrom with
printer drivers. Any suggestions?

-----Original Message-----
dear steve ,sorry for caps
in a win2k sp4 system (notebook) after using software a
reboot option apears.if you do this 16 bit subsystem is
destroyed by deleted autoexec.nt
now if you have a copy of the file it's ok if you don't ??
also ist toolbal side bar & other .exe files at c:\winnt
folder do not removed and keep regenerating them selfs.
so its endless procedure without performing anything!!
-----Original Message-----
I do not understand the issue you are running into. Can you
clarify the issue without using all caps?

-steve


Steve Dodson [MSFT]
MCSE, CISSP
PSS Security

--

This posting is provided "AS IS" with no warranties, and confers
no rights. Use of included script samples are subject to the terms
specified at http://www.microsoft.com/info/cpyright.htm

Note: For the benefit of the community-at-large, all responses to
this message are best directed to the newsgroup/thread from which
they originated.
--------------------
Content-Class: urn:content-classes:message
From: "lambros" <[email protected]>
Sender: "lambros" <[email protected]>
Subject: autoexec.nt deletion
Date: Thu, 27 Jan 2005 01:19:53 -0800
Lines: 14
Message-ID: <[email protected]>
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Newsreader: Microsoft CDO for Windows 2000
thread-index: AcUEUVxq6zGUfJ/VTPCeOCJ40reTDg==
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300
Newsgroups:
microsoft.private.security.spyware.networking
Path: cpmsftngxa10.phx.gbl
Xref: cpmsftngxa10.phx.gbl
microsoft.private.security.spyware.networking:447
NNTP-Posting-Host: tk2msftngxa13.phx.gbl 10.40.1.165
X-Tomcat-NG:
microsoft.private.security.spyware.networking

IN SEVERALL CASES AFTER CLEANING COMPUTER , A MESSAGE FOR
REBOOT NEED IS DISPLAYED.AT THIS POINT YOU CAN SEE
A "LARGE" IT'S NOW SAFE TO TURN YOUR COMPUTER MESSAGE!!
AFTER RESTART LOOK UP AT C:\WINNT\SYSTEM32 FOR AUTOEXEC.NT
BECAUSE AT CLEANING PROCEDURE OFTEN IS BEEING DELETED!!
IF YOU HAVE A COPY OF THIS FILE PASTE INTO THE CERTAIN
DIRECTORY & YOU WILL NOT HAVE PROBLEMS.TO UNDERSTAND IF
YOU HAVE THIS PROBLEM LOOK OUT FOR MESSAGES "WINDOWS CAN
NOT WORK AT 16bit SUBSYSTEM OR SOMETHING LIKE THAT WITH
APPLICATIONS.
AS FOR SECURITY FORGET IT BECAUSE MALICIOUS SOFTWARE STILL
INSTALLED PASSING THROUGH SHIELD!!! (INVALID INSTALLATION
MESAAGES DURING STBY MODE!!!
HEEEEEEEEEEELP!!!!!!!!!!!!


.

.

.