Running Norton - Try a clean boot

[Clarence \(Lancy\) Howard]

Hi folks

One for your amusement. If you are running Norton and have a diskette drive
on your machine, then do a clean boot from a diskette.

Change directory to C:_RESTORE\TEMP

Take a directory listing. Do you see the last file in the list? Well.....
delete it. Take another directory listing and ask yourself why there is
another file with a higher name than the one you just deleted.

Interesting, isn't it.

Clarence (Lancy) Howard
(e-mail address removed) (remove one of the 7s)

 

[Jake Dodd]

Hi folks

One for your amusement. If you are running Norton and have a diskette drive
on your machine, then do a clean boot from a diskette.

Change directory to C:_RESTORE\TEMP

You have to be using WinME to have this folder by default. It is a "special"
folder.

Take a directory listing. Do you see the last file in the list? Well.....
delete it. Take another directory listing and ask yourself why there is
another file with a higher name than the one you just deleted.

Interesting, isn't it.

Are you clean booting with a WinME boot disk? What does Norton have
to do with WinME's system restore feature?

 

[Clarence \(Lancy\) Howard]

Hi Jake

You have to be using WinME to have this folder by default. It is a "special"
folder.

I'm messing around with the machine I had that was faulty. I'm just trying
to find out what was wrong with it.

Are you clean booting with a WinME boot disk? What does Norton have
to do with WinME's system restore feature?

Even if I am (or am not), why should it matter what OS I'm booting with???

You seem to know quite a lot about this. I'm intrigued.

Is it WinME that is sticking all these references into the MBR (y'know
1,2,3,......32768)?

What happens when it gets to 32,769?

Is it WinME that is sending dopey code to the CMOS?

What possible benefit could there be to ME by copying semaphore files that
have 0 bytes?

I could ask more questions, but a simple answer to those ones might steer me
on the good path.

I'd be grateful for your suggestions.

Clarence (Lancy) Howard
(e-mail address removed) (remove one of the 7s)

 

[Clarence \(Lancy\) Howard]

Hi Jake (again)

Y'know, since I've come in here (with a very serious problem) you have
stated "Oh he's talking out his ass" and you have only asked questions. Yet,
all the time it appears that you have known that my problem was something to
do with ME. Why didn't you just say that I was barking up the wrong tree,
try something else.

I've been slagging of Symantec and you are now saying "Oh this is a special
folder" and then ask another question.

Once I got the data out of the machine I could then experiment with it. I
think it is entirely reasonable that a computer user should be allowed to
investigate a machine that is not working properly. Once I rebooted the sick
drive I took it back out of the machine and linked up the old DOS drive
again. Again, there was garbage in the CMOS. I once again cleaned out the
CMOS with the old DOS drive in it. I then reaffected (infected is an
incorrect word) the CMOS by booting from the sick drive. By trying a clean
boot and deleting a file I now know that it is impossible to start this
machine from a clean boot.

You said "Oh he's talking out his ass". This machine has a problem that is
arising from the hard disk. It is causing the CMOS to point to the MBR of
the sick drive and it is impossible to get a clean boot.

Is it a coincidence that there were 32,768 files in this "special" folder
when this machine started to go really bizare? It just happens that a 32 bit
byte comes to 32,768. I also just happen to find the characters 00000....1
through to 11111....1 in the MBR.

I've also found some oddities in the FAT.

I don't think there is a virus on board.

You say "he's talking out his ass" yet you seem to know what might have been
wrong. Why did you bother?

Clarence (Lancy) Howard
(e-mail address removed) (remove one of the 7s)

 

[Clarence \(Lancy\) Howard]

hmmmm........ This thread needs to be lightened up a bit. Where are you
pcbutts1?

Go on, tell me, "You're still a dork", or, dare I suggest, support me with a
"Go, get him Dork".

I really don't mind if you bottom post or top post. Honest.

Clarence (Lancy) Howard
(e-mail address removed) (remove one of the 7s)

 

[Heather]

Sweetheart.....if I am reading between the lines right, you are finding
hundreds (or thousands) of these zero byte files, correct? I told you
yesterday to come over to the WinMe groups and they would sort you out.

As I do NOT use Norton, I have never had this problem with WinME, but it
is well documented by the gurus on our ng's.....and I never kept a copy
of the fix.....which frankly is get rid of Norton.

I will take a look in Google if you wish, or direct you to Noel Paton or
Mike Maltby who will sort you out in a flash. And no, you are not
'talking out of your ass", lol.

So...was that the problem?? (not your ass, but the thousands of zero
byte files)

Cheers....Heather

 

[Clarence \(Lancy\) Howard]

Hi Heather

Sweetheart.....if I am reading between the lines right, you are finding
hundreds (or thousands) of these zero byte files, correct? ...

Yes and no. Trying to write on lines is difficult enough. I have no hidden
agenda. Anyway, where did the "Sweetheart" come from? I just a cantankerous

...... I told you yesterday to come over to the WinMe groups
and they would sort you out.

I've just been there, posting. Not about this issue. I was being helpful.

As I do NOT use Norton, I have never had this problem with WinME, but it
is well documented by the gurus on our ng's.....and I never kept a copy
of the fix.....which frankly is get rid of Norton.

Well.... I wouldn't use Norton, but that is a personal choice. I don't
advocate do this or do that.

Realistically, now that I can access the machine without fear of losing data
the better I can understand what happened. The more I'm looking at the
problem the more I'm tending to think the Norton might have been the victim,
not the miscreant. Indeed, if I find that the problem is not Norton I will
definitely post an open apology here. I would also like to say that although
my rants and raves about legality would be correct if Norton had done what I
thought it did, there's still a moral issue here. Would I really want to
prohibit access to downloads by millions of Europeans just because one
machine screwed up. I was really just wanting somebody from Symantec to
contact me.

I will take a look in Google if you wish, or direct you to Noel Paton or
Mike Maltby who will sort you out in a flash. And no, you are not
'talking out of your ass", lol.

I'm already sorted. Don Kelloways suggestion worked a treat. I'm from
Northern Ireland and quite a lot of us Norn Irons do give out a bit of
verbal diarrhoea from time to time. I don't imagine that I am an exception.
I'm sure that throughout that raving session I did talk out of ass somewhat.

So...was that the problem?? (not your ass, but the thousands of zero
byte files)

The zero byte files don't bother me. I can think of a meriad of reasons for
even holding copies of semaphores. What bothers me is how many files,
regardless of the number of bytes, there were. There were 32768. If there
had been 33545 or 31267 it wouldn't have bothered me at all.

Maybe it's just something that Dorks like me are not meant to know.

Clarence (Lancy) Howard
<[email protected] (remove one of the 7s)

 

[Heather]

Hi Heather


Yes and no. Trying to write on lines is difficult enough. I have no
hidden
agenda. Anyway, where did the "Sweetheart" come from? I just a >
cantankerous old fart, or a Dork (if Dork is appropriate). <g>

We Canadians are a friendly lot.....rather like the Irish, lol.

I've just been there, posting. Not about this issue. I was being
helpful.

Hmmm, didn't see you over there. I just checked. Not too much traffic
these days. But we are seeing a lot of secondhand owners. So the fixes
are being regurgitated.

Well.... I wouldn't use Norton, but that is a personal choice. I don't
advocate do this or do that.

Norton plays hell with WinME. Has for several versions.

I'm already sorted. Don Kelloways suggestion worked a treat. I'm from
Northern Ireland and quite a lot of us Norn Irons do give out a bit of
verbal diarrhoea from time to time. I don't imagine that I am an
exception.

It certainly seemed like the logical solution. Glad it worked for you.

Now.....get to bed!! It is 3 am over in Norn Iron.

Cheers.....Heather (not Irish obviously)

 

[Jake Dodd]

Hi Jake

Hi Clarence.

I'm messing around with the machine I had that was faulty. I'm just trying
to find out what was wrong with it.

That's good.

Even if I am (or am not), why should it matter what OS I'm booting with???

WinME has a "system restore" feature and "file change monitoring" which may
do things that those more familiar with Win9x may find puzzling.

You seem to know quite a lot about this. I'm intrigued.

I don't use WinME myself, I was just trying to help clear up some
misconceptions you might have. Sorry if I offended, and I shall not
contimue to do so.

Is it WinME that is sticking all these references into the MBR (y'know
1,2,3,......32768)?

I don't know, but I do know that WinME has system restore which uses
the C:\_restore folder and IIRC there will be at least one file created in
that folder by the system if it is found to be mising. Also, whenever an
executable file is changed (deleted, renamed, or otherwise modified) the
system will attempt to preserve a pre-modification copy of that file in the
somewhere in the _restore directory tree hierarchy..

What happens when it gets to 32,769?

I don't know.

Is it WinME that is sending dopey code to the CMOS?

I don't know, and the CMOS shouldn't have code. The CMOS is a storage
area for the BIOS to use to help get the hardware supported and configured.
As far as I know, the only program that should write into the CMOS is the
CMOS setup program in the BIOS.

What possible benefit could there be to ME by copying semaphore files that
have 0 bytes?

Semaphore files? - again, I don't know.

I could ask more questions, but a simple answer to those ones might steer me
on the good path.

I'd be grateful for your suggestions.

Sorry I can't help you.

You might want to peruse this if you get some spare time:

http://support.microsoft.com/default.aspx?scid=kb;en-us;267951

Windows ME restore feature explained.

 

[Jake Dodd]

Hi Jake (again)

Y'know, since I've come in here (with a very serious problem) you have
stated "Oh he's talking out his ass" and you have only asked questions.

I won't do it anymore.

Yet,
all the time it appears that you have known that my problem was something to
do with ME. Why didn't you just say that I was barking up the wrong tree,
try something else.

I felt that your biggest problem was the conjecturing (how did you put it in
another post - "verbal diarrhea"? ) Forget the guesswork when asking for
assistance, it only provides more avenues for misdirection.

I've been slagging of Symantec and you are now saying "Oh this is a special
folder" and then ask another question.

Explained (hopefully) in another post.

[snipped]

I don't think there is a virus on board.

Neither do I.

You say "he's talking out his ass" yet you seem to know what might have been
wrong. Why did you bother?

I've been wondering about that myself. I won't bother anymore.

 

[Jake Dodd]

Hi Clarence (again) )

More detailed description of WinME (SR) here:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnsetup/html/winmesr.asp

 

[Jake Dodd]

And no, you are not 'talking out of your ass", lol.

So, he really does have a CMOS/MBR/NTFS (also known as a
CMOS/MBR/FAT) virus? And he really does have proof that
Norton messes around with the MBR and the CMOS?

I wasn't doubting that he has problems with Norton (who doesn't?),
he was "embellishing" to the point of obfuscating the real issue.

BTW, I would be interested in reading the ME groups treatise on this
evidently common Norton on ME problem. Is there a URL they point
people to or do they only type this info into the group?

 

[Heather]

So, he really does have a CMOS/MBR/NTFS (also known as a
CMOS/MBR/FAT) virus? And he really does have proof that
Norton messes around with the MBR and the CMOS?

I wasn't doubting that he has problems with Norton (who doesn't?),
he was "embellishing" to the point of obfuscating the real issue.

BTW, I would be interested in reading the ME groups treatise on this
evidently common Norton on ME problem. Is there a URL they point
people to or do they only type this info into the group?

Hi Jake.....

I do agree that perhaps he should list the problems in point form as
they happened. I am a bit lost myself and I certainly don't have your
knowledge.

As for Norton messing up WinME, Noel Paton or Mike Maltby usually sort
the person out by posts.....there is an MS KB link for the thousands of
zero byte files, as I recall. But unfortunately, as I do not use
Norton, I haven't experienced the myriad of problems that it causes.

Noel is in the UK, so should be around here in another 6 hours or so and
hopefully he can point you in the right direction. I don't think I ever
kept a *boilerplate* set of instructions for Norton problems.

Cheers.....Heather

 

[Clarence \(Lancy\) Howard]

Hi Jake

WinME has a "system restore" feature and "file change monitoring" which may
do things that those more familiar with Win9x may find puzzling.


I don't use WinME myself, I was just trying to help clear up some
misconceptions you might have. Sorry if I offended, and I shall not
contimue to do so.

Jeeze Jake, don't take me seriously. My skin is old and cold as a lizard

I don't use it either. However my sister in law does so I have used the
restore feature on her machine many times. It was a value judgement I had to
make. I couldn't even try the restore because the machine was hanging
(seriously hanging) very shortly after startup. If it hung in the middle of
a restore I might have really ****ed it up.

I don't know, but I do know that WinME has system restore which uses
the C:\_restore folder and IIRC there will be at least one file created in
that folder by the system if it is found to be mising. Also, whenever an
executable file is changed (deleted, renamed, or otherwise modified) the
system will attempt to preserve a pre-modification copy of that file in the
somewhere in the _restore directory tree hierarchy..

I was aware of that also. When I did my first delete I took a copy of the
file to a floppy before I deleted it. It was then that I noticed that
another file had been created.

I don't know.

Neither do I.

I don't know, and the CMOS shouldn't have code. The CMOS is a storage
area for the BIOS to use to help get the hardware supported and configured.
As far as I know, the only program that should write into the CMOS is the
CMOS setup program in the BIOS.

Agreed. Though, shouldn't is different from can't.

Semaphore files? - again, I don't know.

Alas, I do know this. Windows can't actually tell whether programs need the
semaphore files or not so it does have to make copies.

Sorry I can't help you.

You may think you have not helped, but you have. People taking an interest
in this has kept me in the right direction. I now have the data (and the
cabinet files) so I could simply FDISK and create a new computer. But, I'm
determined to find out what's happening.

Clarence (Lancy) Howard
(e-mail address removed) (remove one of the 7s)

 

[Jake Dodd]

Noel is in the UK, so should be around here in another 6 hours or so and
hopefully he can point you in the right direction. I don't think I ever
kept a *boilerplate* set of instructions for Norton problems.

Mostly I was curious if the WinME SR feature and NAV together were
generating those files and because NAV assumed Win9x = WinME it
was touted as being compatible with ME.

For the record, I don't like NAV (nor many of the others) because they
try to do too much. Give me a nuts & bolts scanner to use with my safe
practices and I'm happy. I try to stay away from mobile code - I don't
do much downloading of executables which makes it easier to keep up
with scanning before trying them out. I don't like applications that do the
downloading and executing automatically, so I disable scripting, ActiveX,
and Java. Spartan, but relatively secure. Eventually I fear it will become
impossible to do without active scanning as the OS will just be a node in
a vast mobile code jungle and the difficulty in identifying perimeters will
make active scanning the only thing that works.

Thanks for your help.