System 32

  • Thread starter Thread starter Cynthia
  • Start date Start date
C

Cynthia

I posted my problem and got this reply. can someone
translate it to me like you're talking to a five-year-old?


Go to run,type:cmd In cmd type:Sfc /Scannow When the
graph starts
install xp cd,exit the info page,when its thru
type:EXIT Restart computer,
run the DOS screen in Min.,sometimes the graph runs
behind it.



(this was my original message)
I got a virus (dluca.e) and i ran norton to get rid of
it. the virus was in c:/winnt/system32/wdwctrl.exe.
i really don't know much about computers, and in the
process of removing the virus (successfully), i may have
deleted something essential from the regsitry.

the problem now is this:
the system 32 folder shows up every time i start the
computer. i tried all the troubleshooting, including this:

Visit http://www.kellys-korner-xp.com/xp_tweaks.htm and
scroll down to Item No. 260. In the right column, click
on "System32 Folder Opens Upon Boot". Download this
repair file and then run the repair.

when i run this repair, it says the item cannot be found
in the registry. can anyone help?
 
Hi Cynthia,

Somewhat complicated instructions to do something that won't help the
problem. Kelly's edit doesn't help because it resolves a known issue
involving a sound card (and it is quite common, so her edit resolves about
90% of these requests). What you have is some registry damage from the
virus. Could you please export and post the contents of these keys in the
registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

To do this, start/run regedit, expand the branches to each key (do this one
at a time). Click on the key, then on file/export. Give it any name, then
save to the desktop. Once you have saved both keys, close the registry
editor. Right-click one of the saved files on the desktop, choose edit, it
should open in notepad. Click edit/select all/edit/copy. Open a response to
this post and click in the message text area. Hit ctrl+v to paste the
contents. Repeat for the other saved key, then send the post for
examination.

--
Best of Luck,

Rick Rogers aka "Nutcase" MS-MVP - Windows
Windows isn't rocket science! That's my other hobby!

Associate Expert - WinXP - Expert Zone
 
here it is:
thank you so much!!!!!

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Run]
"IM"="\"C:\\PROGRA~1\\EARTHL~2\\aim.exe \" -cnetwait.odl"
"IncrediMail"="\"C:\\PROGRA~1\\INCRED~1\\bin\\IncMail.exe
\" /c"
"SpySweeper"="\"C:\\Program Files\\EarthLink
TotalAccess\\Spyware Blocker\\SpywareBlocker.exe\" /0"
"Yahoo! Pager"="\"C:\\Program Files\\Yahoo!
\\Messenger\\ypager.exe \" -quiet"
"E6TaskPanel"="\"C:\\Program Files\\EarthLink
TotalAccess\\TaskPanl.exe\" -winstart"

--------------and------------------------

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVers
ion\Run]
"IgfxTray"="C:\\WINNT\\System32\\igfxtray.exe"
"HotKeysCmds"="C:\\WINNT\\System32\\hkcmd.exe"
"Hot Key Kbd 9910 Daemon"="\"SK9910DM.EXE\""
"GWMDMMSG"="\"GWMDMMSG.exe\""
"Keyboard Preload
Check"="\"C:\\OEMDRVRS\\KEYB\\Preload.exe
\" /DEVID: /CLASS:Keyboard /RunValue:\"Keyboard Preload
Check\""
"AdaptecDirectCD"="\"C:\\Program Files\\Roxio\\Easy CD
Creator 5\\DirectCD\\DirectCD.exe\""
"Microsoft Works Portfolio"="\"C:\\Program
Files\\Microsoft Works\\WksSb.exe \" /AllUsers"
"Microsoft Works Update Detection"="\"C:\\Program
Files\\Common Files\\Microsoft Shared\\Works
Shared\\WkUFind.exe\""
"MoneyStartUp10.0"="\"C:\\Program Files\\Microsoft
Money\\System\\Activation.exe\""
"WorksFUD"="\"C:\\Program Files\\Microsoft
Works\\wkfud.exe\""
"TkBellExe"="C:\\Program Files\\Common
Files\\Real\\Update_OB\\realsched.exe -osboot"
"QuickTime Task"="\"C:\\Program
Files\\QuickTime\\qttask.exe\" -atboottime"
"Zone Labs Client"="\"C:\\PROGRA~1\\ZONELA~1\\ZONEAL~1
\\zlclient.exe\""
"AVGCtrl"="C:\\Program Files\\AVPersonal\\AVGNT.EXE /min"
"NAV Agent"="C:\\PROGRA~1\\NORTON~1\\navapw32.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVers
ion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVers
ion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVers
ion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVers
ion\Run\OptionalComponents\MSFS]
"Installed"="1"
 
thank you so much, Rick!
i'm sending this again because i forgot to put my name in
the sender box, and i wanted you to know it was me!
cynthia

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Run]
"IM"="\"C:\\PROGRA~1\\EARTHL~2\\aim.exe \" -cnetwait.odl"
"IncrediMail"="\"C:\\PROGRA~1\\INCRED~1\\bin\\IncMail.exe
\" /c"
"SpySweeper"="\"C:\\Program Files\\EarthLink
TotalAccess\\Spyware Blocker\\SpywareBlocker.exe\" /0"
"Yahoo! Pager"="\"C:\\Program Files\\Yahoo!
\\Messenger\\ypager.exe \" -quiet"
"E6TaskPanel"="\"C:\\Program Files\\EarthLink
TotalAccess\\TaskPanl.exe\" -winstart"

--------------and------------------------

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVers
ion\Run]
"IgfxTray"="C:\\WINNT\\System32\\igfxtray.exe"
"HotKeysCmds"="C:\\WINNT\\System32\\hkcmd.exe"
"Hot Key Kbd 9910 Daemon"="\"SK9910DM.EXE\""
"GWMDMMSG"="\"GWMDMMSG.exe\""
"Keyboard Preload
Check"="\"C:\\OEMDRVRS\\KEYB\\Preload.exe
\" /DEVID: /CLASS:Keyboard /RunValue:\"Keyboard Preload
Check\""
"AdaptecDirectCD"="\"C:\\Program Files\\Roxio\\Easy CD
Creator 5\\DirectCD\\DirectCD.exe\""
"Microsoft Works Portfolio"="\"C:\\Program
Files\\Microsoft Works\\WksSb.exe \" /AllUsers"
"Microsoft Works Update Detection"="\"C:\\Program
Files\\Common Files\\Microsoft Shared\\Works
Shared\\WkUFind.exe\""
"MoneyStartUp10.0"="\"C:\\Program Files\\Microsoft
Money\\System\\Activation.exe\""
"WorksFUD"="\"C:\\Program Files\\Microsoft
Works\\wkfud.exe\""
"TkBellExe"="C:\\Program Files\\Common
Files\\Real\\Update_OB\\realsched.exe -osboot"
"QuickTime Task"="\"C:\\Program
Files\\QuickTime\\qttask.exe\" -atboottime"
"Zone Labs Client"="\"C:\\PROGRA~1\\ZONELA~1\\ZONEAL~1
\\zlclient.exe\""
"AVGCtrl"="C:\\Program Files\\AVPersonal\\AVGNT.EXE /min"
"NAV Agent"="C:\\PROGRA~1\\NORTON~1\\navapw32.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVers
ion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVers
ion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVers
ion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVers
ion\Run\OptionalComponents\MSFS]
"Installed"="1"
 
Hi Cynthia,

Ok, they look fine (though there are a couple I would disable - more on that
later). Go to the Control Panel/Folder Options, on the view tab, uncheck the
line "restore previous folder windows at logon". Click apply/ok, do not
reboot yet. Start/run msconfig, on the general tab, click the option to put
the system in diagnostic mode. Click apply/ok and reboot now. When complete,
you should be up and running with minimal services. Now start/run msconfig
again and go back to normal mode, click apply/ok and reboot once more, you
should wind up back in normal mode, but the \system32 folder should no
longer show up. You can leave the option disabled in folder options if you
wish, or you can reenable it.

As to your startup load, I would uncheck the lines that load the following
entries (this will be on the startup tab of msconfig):
"Yahoo! Pager"="\"C:\\Program Files\\Yahoo!\\Messenger\\ypager.exe
\" -quiet"
"Microsoft Works Portfolio"="\"C:\\Program Files\\Microsoft
Works\\WksSb.exe \" /AllUsers"
"Microsoft Works Update Detection"="\"C:\\Program Files\\Common
Files\\Microsoft Shared\\Works Shared\\WkUFind.exe\""
"MoneyStartUp10.0"="\"C:\\Program Files\\Microsoft
Money\\System\\Activation.exe\""
"WorksFUD"="\"C:\\Program Files\\Microsoft Works\\wkfud.exe\""
"TkBellExe"="C:\\Program Files\\Common
Files\\Real\\Update_OB\\realsched.exe -osboot"
"QuickTime Task"="\"C:\\Program
Files\\QuickTime\\qttask.exe\" -atboottime"
Click to expand...

All of these are unnecessarily loading into memory at boot. This does not
remove or disable the programs, you can still use them the same as you
normally do now. You may also want to disable one of these:
"AVGCtrl"="C:\\Program Files\\AVPersonal\\AVGNT.EXE /min"
"NAV Agent"="C:\\PROGRA~1\\NORTON~1\\navapw32.exe"
Click to expand...

They are both real-time scanning agents for competing antivirus software
programs. Running them concurrently can cause system slowdowns as they
compete to scan files that are being used. You can keep both should you
wish, just allow only one to load and scan in real time. Use the other for
"second opinions" on any suspect files. You should keep both up to date.

--
Best of Luck,

Rick Rogers aka "Nutcase" MS-MVP - Windows
Windows isn't rocket science! That's my other hobby!

Associate Expert - WinXP - Expert Zone



Cynthia said:
thank you so much, Rick!
i'm sending this again because i forgot to put my name in
the sender box, and i wanted you to know it was me!
cynthia

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Run]
"IM"="\"C:\\PROGRA~1\\EARTHL~2\\aim.exe \" -cnetwait.odl"
"IncrediMail"="\"C:\\PROGRA~1\\INCRED~1\\bin\\IncMail.exe
\" /c"
"SpySweeper"="\"C:\\Program Files\\EarthLink
TotalAccess\\Spyware Blocker\\SpywareBlocker.exe\" /0"
"Yahoo! Pager"="\"C:\\Program Files\\Yahoo!
\\Messenger\\ypager.exe \" -quiet"
"E6TaskPanel"="\"C:\\Program Files\\EarthLink
TotalAccess\\TaskPanl.exe\" -winstart"

--------------and------------------------

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVers
ion\Run]
"IgfxTray"="C:\\WINNT\\System32\\igfxtray.exe"
"HotKeysCmds"="C:\\WINNT\\System32\\hkcmd.exe"
"Hot Key Kbd 9910 Daemon"="\"SK9910DM.EXE\""
"GWMDMMSG"="\"GWMDMMSG.exe\""
"Keyboard Preload
Check"="\"C:\\OEMDRVRS\\KEYB\\Preload.exe
\" /DEVID: /CLASS:Keyboard /RunValue:\"Keyboard Preload
Check\""
"AdaptecDirectCD"="\"C:\\Program Files\\Roxio\\Easy CD
Creator 5\\DirectCD\\DirectCD.exe\""
"Microsoft Works Portfolio"="\"C:\\Program
Files\\Microsoft Works\\WksSb.exe \" /AllUsers"
"Microsoft Works Update Detection"="\"C:\\Program
Files\\Common Files\\Microsoft Shared\\Works
Shared\\WkUFind.exe\""
"MoneyStartUp10.0"="\"C:\\Program Files\\Microsoft
Money\\System\\Activation.exe\""
"WorksFUD"="\"C:\\Program Files\\Microsoft
Works\\wkfud.exe\""
"TkBellExe"="C:\\Program Files\\Common
Files\\Real\\Update_OB\\realsched.exe -osboot"
"QuickTime Task"="\"C:\\Program
Files\\QuickTime\\qttask.exe\" -atboottime"
"Zone Labs Client"="\"C:\\PROGRA~1\\ZONELA~1\\ZONEAL~1
\\zlclient.exe\""
"AVGCtrl"="C:\\Program Files\\AVPersonal\\AVGNT.EXE /min"
"NAV Agent"="C:\\PROGRA~1\\NORTON~1\\navapw32.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVers
ion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVers
ion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVers
ion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVers
ion\Run\OptionalComponents\MSFS]
"Installed"="1"


-----Original Message-----
Hi Cynthia,

Somewhat complicated instructions to do something that won't help the
problem. Kelly's edit doesn't help because it resolves a known issue
involving a sound card (and it is quite common, so her edit resolves about
90% of these requests). What you have is some registry damage from the
virus. Could you please export and post the contents of these keys in the
registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVers ion\Run
on\Run

To do this, start/run regedit, expand the branches to each key (do this one
at a time). Click on the key, then on file/export. Give it any name, then
save to the desktop. Once you have saved both keys, close the registry
editor. Right-click one of the saved files on the desktop, choose edit, it
should open in notepad. Click edit/select all/edit/copy. Open a response to
this post and click in the message text area. Hit ctrl+v to paste the
contents. Repeat for the other saved key, then send the post for
examination.

--
Best of Luck,

Rick Rogers aka "Nutcase" MS-MVP - Windows
Windows isn't rocket science! That's my other hobby!

Associate Expert - WinXP - Expert Zone






.
Click to expand...
Click to expand...
 
Hi Rick,

The box for "restore previous folder windows at logon" is
already unchecked. What now? I have class until 4 o'clock
today, so I'll check back then. Thanks!
-----Original Message-----
Hi Cynthia,

Ok, they look fine (though there are a couple I would disable - more on that
later). Go to the Control Panel/Folder Options, on the view tab, uncheck the
line "restore previous folder windows at logon". Click apply/ok, do not
reboot yet. Start/run msconfig, on the general tab, click the option to put
the system in diagnostic mode. Click apply/ok and reboot now. When complete,
you should be up and running with minimal services. Now start/run msconfig
again and go back to normal mode, click apply/ok and reboot once more, you
should wind up back in normal mode, but the \system32 folder should no
longer show up. You can leave the option disabled in folder options if you
wish, or you can reenable it.

As to your startup load, I would uncheck the lines that load the following
entries (this will be on the startup tab of msconfig):
"Yahoo! Pager"="\"C:\\Program Files\\Yahoo! \\Messenger\\ypager.exe
\" -quiet"
"Microsoft Works Portfolio"="\"C:\\Program Files\\Microsoft
Works\\WksSb.exe \" /AllUsers"
"Microsoft Works Update Detection"="\"C:\\Program Files\\Common
Files\\Microsoft Shared\\Works Shared\\WkUFind.exe\""
"MoneyStartUp10.0"="\"C:\\Program Files\\Microsoft
Money\\System\\Activation.exe\""
"WorksFUD"="\"C:\\Program Files\\Microsoft Works\\wkfud.exe\""
"TkBellExe"="C:\\Program Files\\Common
Files\\Real\\Update_OB\\realsched.exe -osboot"
"QuickTime Task"="\"C:\\Program
Files\\QuickTime\\qttask.exe\" -atboottime"
Click to expand...

All of these are unnecessarily loading into memory at boot. This does not
remove or disable the programs, you can still use them the same as you
normally do now. You may also want to disable one of these:
"AVGCtrl"="C:\\Program Files\\AVPersonal\\AVGNT.EXE /min"
"NAV Agent"="C:\\PROGRA~1\\NORTON~1\\navapw32.exe"
Click to expand...

They are both real-time scanning agents for competing antivirus software
programs. Running them concurrently can cause system slowdowns as they
compete to scan files that are being used. You can keep both should you
wish, just allow only one to load and scan in real time. Use the other for
"second opinions" on any suspect files. You should keep both up to date.

--
Best of Luck,

Rick Rogers aka "Nutcase" MS-MVP - Windows
Windows isn't rocket science! That's my other hobby!

Associate Expert - WinXP - Expert Zone



thank you so much, Rick!
i'm sending this again because i forgot to put my name in
the sender box, and i wanted you to know it was me!
cynthia

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Run]
"IM"="\"C:\\PROGRA~1\\EARTHL~2\\aim.exe \" - cnetwait.odl"
"IncrediMail"="\"C:\\PROGRA~1\\INCRED~1 \\bin\\IncMail.exe
\" /c"
"SpySweeper"="\"C:\\Program Files\\EarthLink
TotalAccess\\Spyware Blocker\\SpywareBlocker.exe\" /0"
"Yahoo! Pager"="\"C:\\Program Files\\Yahoo!
\\Messenger\\ypager.exe \" -quiet"
"E6TaskPanel"="\"C:\\Program Files\\EarthLink
TotalAccess\\TaskPanl.exe\" -winstart"

--------------and------------------------

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVers
ion\Run]
"IgfxTray"="C:\\WINNT\\System32\\igfxtray.exe"
"HotKeysCmds"="C:\\WINNT\\System32\\hkcmd.exe"
"Hot Key Kbd 9910 Daemon"="\"SK9910DM.EXE\""
"GWMDMMSG"="\"GWMDMMSG.exe\""
"Keyboard Preload
Check"="\"C:\\OEMDRVRS\\KEYB\\Preload.exe
\" /DEVID: /CLASS:Keyboard /RunValue:\"Keyboard Preload
Check\""
"AdaptecDirectCD"="\"C:\\Program Files\\Roxio\\Easy CD
Creator 5\\DirectCD\\DirectCD.exe\""
"Microsoft Works Portfolio"="\"C:\\Program
Files\\Microsoft Works\\WksSb.exe \" /AllUsers"
"Microsoft Works Update Detection"="\"C:\\Program
Files\\Common Files\\Microsoft Shared\\Works
Shared\\WkUFind.exe\""
"MoneyStartUp10.0"="\"C:\\Program Files\\Microsoft
Money\\System\\Activation.exe\""
"WorksFUD"="\"C:\\Program Files\\Microsoft
Works\\wkfud.exe\""
"TkBellExe"="C:\\Program Files\\Common
Files\\Real\\Update_OB\\realsched.exe -osboot"
"QuickTime Task"="\"C:\\Program
Files\\QuickTime\\qttask.exe\" -atboottime"
"Zone Labs Client"="\"C:\\PROGRA~1\\ZONELA~1\\ZONEAL~1
\\zlclient.exe\""
"AVGCtrl"="C:\\Program Files\\AVPersonal\\AVGNT.EXE /min"
"NAV Agent"="C:\\PROGRA~1\\NORTON~1\\navapw32.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVers
ion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVers
ion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVers
ion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVers
ion\Run\OptionalComponents\MSFS]
"Installed"="1"


-----Original Message-----
Hi Cynthia,

Somewhat complicated instructions to do something that won't help the
problem. Kelly's edit doesn't help because it resolves
Click to expand...
a
known issue
involving a sound card (and it is quite common, so her edit resolves about
90% of these requests). What you have is some registry damage from the
virus. Could you please export and post the contents of these keys in the
registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVe
Click to expand...
rs
ion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVer
Click to expand...
si
on\Run
To do this, start/run regedit, expand the branches to each key (do this one
at a time). Click on the key, then on file/export. Give it any name, then
save to the desktop. Once you have saved both keys, close the registry
editor. Right-click one of the saved files on the desktop, choose edit, it
should open in notepad. Click edit/select
Click to expand...
all/edit/copy.
Open a response to
this post and click in the message text area. Hit
Click to expand...
ctrl+v
to paste the
contents. Repeat for the other saved key, then send the post for
examination.

--
Best of Luck,

Rick Rogers aka "Nutcase" MS-MVP - Windows
Windows isn't rocket science! That's my other hobby!

Associate Expert - WinXP - Expert Zone



"Cynthia" <[email protected]> wrote
Click to expand...
in
message
I posted my problem and got this reply. can someone
translate it to me like you're talking to a five-
Click to expand...
year-
old?
Go to run,type:cmd In cmd type:Sfc /Scannow When the
graph starts
install xp cd,exit the info page,when its thru
type:EXIT Restart computer,
run the DOS screen in Min.,sometimes the graph runs
behind it.



(this was my original message)
I got a virus (dluca.e) and i ran norton to get rid of
it. the virus was in c:/winnt/system32/wdwctrl.exe.
i really don't know much about computers, and in the
process of removing the virus (successfully), i may have
deleted something essential from the regsitry.

the problem now is this:
the system 32 folder shows up every time i start the
computer. i tried all the troubleshooting, including this:

Visit http://www.kellys-korner-xp.com/xp_tweaks.htm and
scroll down to Item No. 260. In the right column, click
on "System32 Folder Opens Upon Boot". Download this
repair file and then run the repair.

when i run this repair, it says the item cannot be found
in the registry. can anyone help?



.
Click to expand...
Click to expand...


.
Click to expand...
 
hi, rick!
i'm not sure which part did it, but it seems to be fixed!
thanks again!

cynthia

-----Original Message-----
Hi Cynthia,

Ok, they look fine (though there are a couple I would disable - more on that
later). Go to the Control Panel/Folder Options, on the view tab, uncheck the
line "restore previous folder windows at logon". Click apply/ok, do not
reboot yet. Start/run msconfig, on the general tab, click the option to put
the system in diagnostic mode. Click apply/ok and reboot now. When complete,
you should be up and running with minimal services. Now start/run msconfig
again and go back to normal mode, click apply/ok and reboot once more, you
should wind up back in normal mode, but the \system32 folder should no
longer show up. You can leave the option disabled in folder options if you
wish, or you can reenable it.

As to your startup load, I would uncheck the lines that load the following
entries (this will be on the startup tab of msconfig):
"Yahoo! Pager"="\"C:\\Program Files\\Yahoo! \\Messenger\\ypager.exe
\" -quiet"
"Microsoft Works Portfolio"="\"C:\\Program Files\\Microsoft
Works\\WksSb.exe \" /AllUsers"
"Microsoft Works Update Detection"="\"C:\\Program Files\\Common
Files\\Microsoft Shared\\Works Shared\\WkUFind.exe\""
"MoneyStartUp10.0"="\"C:\\Program Files\\Microsoft
Money\\System\\Activation.exe\""
"WorksFUD"="\"C:\\Program Files\\Microsoft Works\\wkfud.exe\""
"TkBellExe"="C:\\Program Files\\Common
Files\\Real\\Update_OB\\realsched.exe -osboot"
"QuickTime Task"="\"C:\\Program
Files\\QuickTime\\qttask.exe\" -atboottime"
Click to expand...

All of these are unnecessarily loading into memory at boot. This does not
remove or disable the programs, you can still use them the same as you
normally do now. You may also want to disable one of these:
"AVGCtrl"="C:\\Program Files\\AVPersonal\\AVGNT.EXE /min"
"NAV Agent"="C:\\PROGRA~1\\NORTON~1\\navapw32.exe"
Click to expand...

They are both real-time scanning agents for competing antivirus software
programs. Running them concurrently can cause system slowdowns as they
compete to scan files that are being used. You can keep both should you
wish, just allow only one to load and scan in real time. Use the other for
"second opinions" on any suspect files. You should keep both up to date.

--
Best of Luck,

Rick Rogers aka "Nutcase" MS-MVP - Windows
Windows isn't rocket science! That's my other hobby!

Associate Expert - WinXP - Expert Zone



thank you so much, Rick!
i'm sending this again because i forgot to put my name in
the sender box, and i wanted you to know it was me!
cynthia

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersi
on\Run]
"IM"="\"C:\\PROGRA~1\\EARTHL~2\\aim.exe \" - cnetwait.odl"
"IncrediMail"="\"C:\\PROGRA~1\\INCRED~1 \\bin\\IncMail.exe
\" /c"
"SpySweeper"="\"C:\\Program Files\\EarthLink
TotalAccess\\Spyware Blocker\\SpywareBlocker.exe\" /0"
"Yahoo! Pager"="\"C:\\Program Files\\Yahoo!
\\Messenger\\ypager.exe \" -quiet"
"E6TaskPanel"="\"C:\\Program Files\\EarthLink
TotalAccess\\TaskPanl.exe\" -winstart"

--------------and------------------------

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVers
ion\Run]
"IgfxTray"="C:\\WINNT\\System32\\igfxtray.exe"
"HotKeysCmds"="C:\\WINNT\\System32\\hkcmd.exe"
"Hot Key Kbd 9910 Daemon"="\"SK9910DM.EXE\""
"GWMDMMSG"="\"GWMDMMSG.exe\""
"Keyboard Preload
Check"="\"C:\\OEMDRVRS\\KEYB\\Preload.exe
\" /DEVID: /CLASS:Keyboard /RunValue:\"Keyboard Preload
Check\""
"AdaptecDirectCD"="\"C:\\Program Files\\Roxio\\Easy CD
Creator 5\\DirectCD\\DirectCD.exe\""
"Microsoft Works Portfolio"="\"C:\\Program
Files\\Microsoft Works\\WksSb.exe \" /AllUsers"
"Microsoft Works Update Detection"="\"C:\\Program
Files\\Common Files\\Microsoft Shared\\Works
Shared\\WkUFind.exe\""
"MoneyStartUp10.0"="\"C:\\Program Files\\Microsoft
Money\\System\\Activation.exe\""
"WorksFUD"="\"C:\\Program Files\\Microsoft
Works\\wkfud.exe\""
"TkBellExe"="C:\\Program Files\\Common
Files\\Real\\Update_OB\\realsched.exe -osboot"
"QuickTime Task"="\"C:\\Program
Files\\QuickTime\\qttask.exe\" -atboottime"
"Zone Labs Client"="\"C:\\PROGRA~1\\ZONELA~1\\ZONEAL~1
\\zlclient.exe\""
"AVGCtrl"="C:\\Program Files\\AVPersonal\\AVGNT.EXE /min"
"NAV Agent"="C:\\PROGRA~1\\NORTON~1\\navapw32.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVers
ion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVers
ion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVers
ion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVers
ion\Run\OptionalComponents\MSFS]
"Installed"="1"


-----Original Message-----
Hi Cynthia,

Somewhat complicated instructions to do something that won't help the
problem. Kelly's edit doesn't help because it resolves
Click to expand...
a
known issue
involving a sound card (and it is quite common, so her edit resolves about
90% of these requests). What you have is some registry damage from the
virus. Could you please export and post the contents of these keys in the
registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVe
Click to expand...
rs
ion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVer
Click to expand...
si
on\Run
To do this, start/run regedit, expand the branches to each key (do this one
at a time). Click on the key, then on file/export. Give it any name, then
save to the desktop. Once you have saved both keys, close the registry
editor. Right-click one of the saved files on the desktop, choose edit, it
should open in notepad. Click edit/select
Click to expand...
all/edit/copy.
Open a response to
this post and click in the message text area. Hit
Click to expand...
ctrl+v
to paste the
contents. Repeat for the other saved key, then send the post for
examination.

--
Best of Luck,

Rick Rogers aka "Nutcase" MS-MVP - Windows
Windows isn't rocket science! That's my other hobby!

Associate Expert - WinXP - Expert Zone



"Cynthia" <[email protected]> wrote
Click to expand...
in
message
I posted my problem and got this reply. can someone
translate it to me like you're talking to a five-
Click to expand...
year-
old?
Go to run,type:cmd In cmd type:Sfc /Scannow When the
graph starts
install xp cd,exit the info page,when its thru
type:EXIT Restart computer,
run the DOS screen in Min.,sometimes the graph runs
behind it.



(this was my original message)
I got a virus (dluca.e) and i ran norton to get rid of
it. the virus was in c:/winnt/system32/wdwctrl.exe.
i really don't know much about computers, and in the
process of removing the virus (successfully), i may have
deleted something essential from the regsitry.

the problem now is this:
the system 32 folder shows up every time i start the
computer. i tried all the troubleshooting, including this:

Visit http://www.kellys-korner-xp.com/xp_tweaks.htm and
scroll down to Item No. 260. In the right column, click
on "System32 Folder Opens Upon Boot". Download this
repair file and then run the repair.

when i run this repair, it says the item cannot be found
in the registry. can anyone help?



.
Click to expand...
Click to expand...


.
Click to expand...
 
Back
Top