Posts by gerbil

Set is looking for a defined variable; "drive" is not defined in the command shell environment. You will have to create your variablename first, so at the head of your batchfile put this line:
set varname=drive
And it should then accept the set drive=x: lines.
Oh, and be careful of spaces - any after the = are part of the name.
You do realise that this will not be permanent? Your newly created variable "drive" will only exist in the current shell environment - you close it and it is gone.

Just power off at the wall, ground your hands to the chassis and remove extra sticks of RAM.... and swap if it does not work. Memtest86 loaded onto a floppy will check your RAM for you [no OS required, it is bootable]. Consider also mb overheating... it may not be the cpu but the Northbridge or Southbridge which is giving trouble. On an Intel-based machine the Southbridge gets a heavy workout with all the disk activity during Setup.... if you feel comfortable doing it then release the SB heatsink, check the paste is plentiful and soft else renew it, reclip the heatsink. Course, you gotta have heatsink paste... your local tech may give you a smear.

The MBR is on the first sector of the disk, LBA 0. It is 512B.
That aside, when you formatted your disk with Setup at the time of the fresh installation a new MBR was written. A bit out of my depth here... but Setup examines your disk [reads it] to start with, checking for old installations, so I guess it is possible that Setup could have been infected.... and of course, not being able to go online, you don't have an active AV running to check for such pests during a boot scan.
So..... get a disk wiper pgm, one that runs from a floppy. This one: http://www.dban.org/
Then you can erase the disk securely [a format is not such]. And reinstall. It's all fun.
I'd reinstall anyway... a fresh installations that has early problems is just not worth trouble-shooting, just shooting.

Did you stop Spybot blocking file alterations, as in:
Spybot : click Tools, Hosts File, uncheck "Lock Hosts file read-only as protection against hijackers" ?
What Spybot does, if you attempt to change the hosts file attributes via the attrib cmd line i gave, is automatically set those attributes again so as to protect the file.

Fixmbr does not repair the partition table in the MBR, all it does is rewrite the code section with M$ standard code.
What do you mean, you found the MBR in two sectors? It must be in the first sector of a disk, before any partitions. It cannot be split, or it would not be found to be readable. [You cannot have a GUID and XP]. Further, you booted into your OS, so the MBR and partition table were read and correct.
Your Active AV should detect any virus and repair your MBR. So, you are in Windows... the MBR has been read and partitions noted; it is done with. Your problem is solely with the OS, and my guessing is pointless.
How about you run these and post the logs:
==Please download Malwarebytes' Anti-Malware
from: http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html
or: http://www.besttechie.net/tools/mbam-setup.exe
=Dclick that file, mbam-setup.exe, to install the application,
-ensure that it is set to update and start, else start it via the icon, and UPDATE it.
Select "Perform QUICK Scan", then click Scan; the application will guide you through the remaining steps.
ENSURE that EVERYTHING found has a CHECKMARK against it, then click Remove Selected.
If malware has been found [and removed] MBAM will automatically produce a log for you when it completes... do not click the Save Logfile button.
Examine the log: if some files are listed as Delete on Reboot then restart your …

Grand... why don't you call those folk and suggest they delete that file. C:\WINDOWS\TEMP\FTA9DA.EXE
I can guess that it will not regenerate... if all it did was fool with user accounts in a non-destructive way there would be no point in equipping it so, and if sophisticated enough to have the files and keys to regenerate then MBAM and SAS should have found some of them. Or pointed them out.
Garn... take the kudos.
[an giss those logs...]

You shoulda told em i don't charge... :) I don't like executables running from TEMP folders except as bona fide installers.
No matter.. throwing a computer out is one good way to get rid of malware, if that is what it was. Just gotta work, an good.
Do you think we could start a new antivirus program based on that?
Microtossed work as a name?

Symantec is your active antivirus; trend micro is your firewall.... you are not running it as an active antivirus service also, are you? If so, remove it.
What is this process? C:\WINDOWS\TEMP\FTA9DA.EXE

==download hijackthis: http://www.majorgeeks.com/download5554.html
-copy it to a new FOLDER placed either alongside your program files or on your desktop and then...
-in that folder start HijackThis by dclicking the .exe
-CLOSE ALL OTHER APPLICATIONS and any open windows including the explorer window containing HijackThis.
-click the Scan and Save a Logfile button. Post the log here.

If you would like to clear your hosts file manually [C:\Windows\system32\drivers\etc\hosts] then apart from the helpful guff from M$ which may or may not exist in your hosts file, this should be the only [or bare minimum!!] entry:
127.0.0.1 localhost
Drag Hosts into an empty notepad, edit it and Save.
You may find that you are not able to save the changed/corrected file. This is because some security applications, possibly also various malware, will lock your Hosts file [make it read-only] as a protection. Lock/Unlock hosts exists in Zonealarm and Spybot S&D.
ZoneAlarm : look under firewall, advanced;
Spybot : click Tools, Hosts File, uncheck "Lock Hosts file read-only as protection against hijackers"
Or just...[but a Spybot setting may over-ride this command....] do this:
Go Start, run, type cmd ...and press Enter. Paste this line into the window at the prompt, press Enter, close the window and try to save the file again.
attrib -r -h -s %SystemRoot%\system32\drivers\etc\HOSTS

Ummm... possibly not.... if it was, BIOS just would not list it. As a next step I would check for BIOS corruption - power down your sys at the wall, remove the CMOS battery for five/ten minutes, reinsert and try to boot again.
another option is to read your mb manual - it may refer to a tiny jumper you can place in another socket for a moment.
Keep the side of the box off.... because it may also be a RAM problem. Power off at the wall, remove the sticks one by one and try each time. Ground your hands to the machine chassis before you touch the mb.

Windows Repairs does not fix anything to do with user ccounts... it merely replaces system files and part of the system hive [it rewrites the sys enries, leaves others intact]. And removes all your security updates; doesn't touch any other software, but is able to lose registry entries to some of it.
Anyway, i have nothing to offer except to suggest that you try a rootkit scan. GMER is good.
Download gmer.zip from http://www.majorgeeks.com/GMER_d5198.html
-dclick on gmer.zip and unzip the file to its own folder or to your desktop.
-disconnect from the Internet and close all running programs including those in the system tray (bottom righthand corner ).
-dclick Gmer.exe to start it; uncheck Sections, IAT/EAT, use remaning default settings [ensure your system drive (C: ?) is the only drive checked] just click the Scan button and wait for the scan to finish (do not use your computer during the scan).
-click on the Copy button - this will copy the results to the clipboard. Open Notepad and paste into it.
The result - if positive, please zip it and post as an attachment via Go Advanced.

SMS.. System Mgmnt Server?

Rule 1 - ALWAYS get the installation cds with any computer bought. ALWAYS. Often it is intended that you create a restore set as an initial step when you buy the sys; this is not the same, they are not as useful. You've paid for the OS, make sure you get the disk.
Any matching OS installation cd will do as a source for rundll32.exe. I do not know about W7. but you could copy the file from any XP cd or installation. Run this command if on an installation cd: [D:\ is the disk drive..]
expand D:\i386\rundll32.ex_ c:\windows\system32\rundll32.exe
...else copy it from where you found it to c:\windows\system32
Rundll32.exe is not involved in the launching of msconfig.exe, likewise hlpcntr.exe [system information]. It is involved only if a dll is called by your interaction..eg by using a command or user interface. An example would be when you open the date/time interface [the clock] - timedate.cpl is called. Generally, programs handle the dlls they use themselves without using rundll32.exe.
From your last post it seems that some file associations in registry are damaged also; run this: http://www.dougknox.com/xp/file_assoc.htm
Such broad damaged could have been caused by malware.... where did you find the copy of rundll32.exe?
Task Manager does not tell you if a process is critical to the system or malware. It just lists running processes.

Insert her XP installation cd, go Start, Run, and enter:
sfc /scannow
That should replace it. It will not be in the caches because WIndows would have already restored it to system32 if it was there.

Not all applications that have an entry in the context menu window will be present in that key in the above article http://www.ehow.com/how_5867604_rest...-settings.html
To find some you must do a search in that hive, HKCR, using "contextmenuhandlers" as the search string. And then you must identify each that it finds.... don't remove your audio, video, antivirus etc entries. Be careful!!

Good morning, Loday.... try running it in Safe mode. When you finally get a complete scan done and objects removed, run it again in Normal mode.
What you can also do is run it in Normal mode, judge when you can cancel the scan before it shuts your sys down, select all the objects it has found and fix them, restart the scan. And so on. What you try to do here is perhaps remove some support files that the malware needs each time, so breaking its restorative power.

And wre you able to fix it? This tool makes it very simple, removes protections that malware places.
==download HostsXpert from http://www.funkytoad.com/content/view/13/31/
-click the top button Make Writable if it is available
-click Restore MS Hosts File button.

If you enter this command you will see the default time that you mention...
shutdown -i
By spaces I meant that they should be between parameters, not between parameters and the separators, so: -s -c "Uh-oh..." is how it should be.
As for the hover action, I do not know. Perhaps a hack to lessen the irritation of an unplanned shutdown? [maybe your virus that caper mentioned had a friendly side?]

New computer... new installation... something not right... it may be simple, it may be one of a number of problems that you are only just finding. Frankly, if a new installation does not feel right, reinstall. Why confront more problems further down the track?
Hand it back to the shop.
Maybe they put a net nanny on it....? My saying that sorta impugns your reputation, doesn't it? :)

Hello, loday..
kmg.exe is a pest... malware. May I suggest that you run Malwarebytes Antimalware?
==Please download Malwarebytes' Anti-Malware
from: http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html
or: http://www.besttechie.net/tools/mbam-setup.exe
=Dclick that file, mbam-setup.exe, to install the application,
-ensure that it is set to update and start, else start it via the icon, and UPDATE it.
Select "Perform QUICK Scan", then click Scan; the application will guide you through the remaining steps.
ENSURE that EVERYTHING found has a CHECKMARK against it, then click Remove Selected.
If malware has been found [and removed] MBAM will automatically produce a log for you when it completes... do not click the Save Logfile button.
Examine the log: if some files are listed as Delete on Reboot then restart your machine before continuing.
Copy and post that log [it is also saved under Logs tab in MBAM].

It would have been helpful if you had posted your actual batch file, but anyway.... beware of spaces between parameters, and between parameters and their fields. They MUST be there. Wrong format, and it just will not run.
I have the distinct feeling that the people who wrote these command structures were many, and they did not talk to each other.

K. Please delete your copy of hijackthis, dl this one:
== http://www.majorgeeks.com/download5554.html
-copy it to a new FOLDER placed either alongside your program files or on your desktop.
Post a fresh log please.

Missed that, caper. Grrr...
I cannot comment much on PerfectDisk.. but I note that it does registry and pagefile defragmentation in the boot mode. It is a single pass tool. It uses the Window defrag API.
Mydefrag uses the Window defrag API... I guess it may differentiate in how it applies it... where to leave blank space etc. I don't know.
Ntregopt uses a copy/write function? to remove blanks from the registry files - if they are fragmented to begin with and there is no contiguous free space on disk then they shall likely remain fragmented.
I did not know from where you were taking reg sizes... from the numbers given I thought it must be the config folder.
ERUNT gives the size of the current user's registry, not that of all users.
I doubt if disk defragmentation is a perfect thing - the moment windows rewrites a file that is larger than the original plus the free space in its last sector you will get a fragmented file. Unless your defragmenter put free space right there ready to be used. Which, of course, would create a lot of blank spaces on a disk.
Perfectdisk consolidates free space into the largest pieces possible. But really, would you not need free space at the end of every file to avoid fragmentation? Nope, this is not how it works.... new files and fragments go to the new free space... and when next rewritten as larger …

:). Yeah. Always read the instructions. Sometimes, just sometimes where I am concerned, they are good to follow.
But in this case out of habit I put in a "/" before the parameter g. Wrong.
A procedure: download the file msicuu2.exe from http://support.microsoft.com/default.aspx?scid=kb;en-us;290301
Dclick it to install the cleanup application. Go to that Windows Installer Clean Up folder in Program Files and drag a copy of MsiZap.exe to your C: root.
Open a cmd window, and enter:
cd \
msizap g
And bang! it is done.
Remove msiexec.exe and perhaps uninstall the application.

NtRegOpt is fine for removing blank spaces in the registry, but cannot defragment it. Pagedefrag loads to run at boot time [using the standard Windows defragmenter] and because the hives are not loaded at that point they can be processed.
You missed a reg cleaner!! CCleaner has one... :)
I used to occasionally let a reg cleaner loose, but all they seemed to come up with were MRU and similar entries that would be cycled out over time. They would point up maybe 10 or 20 entries that might stick, so no big deal. I decided it was pointless.
My ERUNT daily folder [including Erunt files] is 26.9 MB for SP3.
Don't go by config size... it is loaded with backups and log files etc.

I deleted the software folder ages back because I don't use it [or my sys doesn't]. Tracing.. it is just what this says : http://technet.microsoft.com/en-us/library/cc957864.aspx
Mind that the key they rattle on may differ for different installations. In my Home, it is HKLM\SOFTWARE\Microsoft \Tracing\
Anyway, disable tracing by setting it to 0.
Reg cleaning... it is not worth the time taken. A typical registry occupies maybe 25 - 30 MB, you may clean out 5KB or less. And if you were to run another reg cleaner it would find different things to remove. And after you run a slew of them a quick manual check would find plenty more that you could remove safely.
Probably a better thing is to run Pagedefrag:
http://technet.microsoft.com/en-us/sysinternals/bb545046.aspx

It may be more than just shell32.dll, but the easiest way to replace that is to just open an explorer window to system32, and rename shell32.dll to.. oh... shell32old.dll
Windows should copy in from its store a new shell32.dll within a few seconds. [You may need to jolt it by eg. opening another explorer window]. You will not be able to delete the renamed file until you restart your sys, at which time Windows will be using the new shell32.dll file.
It may also pay to run ...
sfc /scannow
-the sys will request your XP installation cd. This will check the integrity of many windows protected files.

Using the recovery disks supplied with preloaded systems will take your sys back to brand-new state, causing you to lose all data.
Your idea of loading XP onto another hard drive and copying data off the old one is best.
Your sys is unble to read its registry from the hard drive - running chkdsk with the correct parameter to correct errors can sometimes solve this. I do not know what is on your disks, but a borrowed XP installation cd would give you a Recovery Console, from where you could run chkdsk /r
Or, you could download and burn to a cd this iso, then boot from it : http://www.thecomputerparamedic.com/files/rc.iso
It is a Recovery Console.

Ok, type this in at the prompt:
explorer.exe /select, http://www.pandasecurity.com/activescan/index/
That may... may open an explorer window for you and go to that site for a scan. I mean, in a working system it will. You will need Safe Mode with Networking, I guess...
Register for a scan that actually does clean, not merely detect. It is not harmful.
Oh, if you have an AV on board then merely enter the pathname to its executable to start it. eg:
C:\"program files\alwil software\avast4\ashavast.exe"
Or whatever...

You might wish to run Malwarebyte's Antimalware. A quick scan will suffice. altering your Hosts file is not all that the malware you have does to your sys.

http://www.av-test.org/ ?
And comparison of 3 free avs: http://antivirus.about.com/od/antivirussoftwarereviews/a/freeav.htm
Have your AV scanner running when you search for antivirus solutions. Strangely enough, malicious folk seem to think that people doing such searches may be unproteceted.... some sites found thus are risky to even enter.

Hello, Bob
"I've repeatedly tried to change my logon screen saver timeout time "....
Ah, but you cannot do it by the USERS hive because it will be overridden by entries in the CURRENT_USER hive. You are the current user [because you are logged on], so change the relevant key in your hive. Or do it via the desktop snapin... the one you get when you rclick on your desktop, go to properties. Any change you make there will be reflected in your hive. But not in USERS - that is the default family of settings applied to any newly created account. Changes there will not affect settings in accounts already created.
Each user must make that change in their CURRENT_USER hive.

I do not think that this is resulting from a problem with windows per se. That error msg comes from shell32.dll which shows that it iss trying to handle your exe file. Some programs place many entries in the registry concerned with their opening, when you initiate a program explorer searches many keys checking for possible entries; perhaps some are missing or corrupted.
May I suggest that you reinstall a failing software and see if it then runs correctly?

May I suggest that you create a new profile for yourself... ie. a new user [admin, of course][you will have to devise a new name for yourself]; log on to it and check that it works as it should, then delete the old profile.
It's a pity it happened that you did all the updates before you discovered this.... on an un-updated sys I would have simply reinstalled XP cos it only takes a half hour with a fast drive.

You can see mup.sys, therefore it was loaded [by ntldr, which obtained control set info from HKLM\system]; mup.sys is a boot file. But when an attempt was made next to start those drivers, something hung. You do not know what. You could try altering your boot.ini file to include the bootlog parameter, and then read that log file, Ntbtlog.txt from \Windows. Make a boot.ini on another sys, copy it in with RC, read the file with "type" cmd.
You could reset CMOS.
If Repair fails it could be a hardware error [try running chkdsk /r from RC] or that the info in \repair [original? reg files] is corrupt. Repair replaces a lot of system files so it is doubtful that it is one of those drivers which is failing. Try a sys rest instead of entering safe mode.

Format .. /s : this is an MSDOS command to format and copy system files to the drive. With XP, why would you wish to do that? XP will not use them; it will write its own.
Further, when you install XP, Setup formats your selected drive - you get the choice of short [clears the master file table] or full [includes a quick surface check]. So just use your installation cd to do the job. Formatting is no big deal; it does not wipe your disk or anything, it just loses the stuff that is on it.

If this was the case "then had to wait for maybe an hour while watching some percentage go up and up..." then i assume he was watching the chkdsk screen.
If you can enter safe mode with prompt, then run:
chkdsk /f
If you can not enter safe mode then use the Recovery Console [via your XP installation disk] and run:
chkdsk /r
Note the DIFFERENCE.

So it is not softwares that are being prefetched. [And yes, prefetch folder entries would be rebuilt with entries for softwares you used during the sessions after deletion]
Try using selective startup via msconfig to isolate the group causing the problem. I could type all day, but M$ tell you how: http://support.microsoft.com/kb/310353
Restore to before the networking experiment?

Cool. Check that northbridge heatsink too.
There are lots of softwares out there that monitor mb and cpu core temps. Worth having one, i reckon. I decided to use one after the mongrel Intel clip system on the cpu cooler unhitched itself. i noticed one day while checking logs that the cpu temp had been a little high sometimes. It had been to 105degC!!! while using Photoshop. Check was prompted by the shrieking fan. New paste, carefully reclipping the heatsink worked fine. I know, cos I run CoreTemp all the time now.
And my CPU survived those excursions. I stress- checked it with Sandra. At least you build good cpus, Intel.

I think you have a case of Installer bloat there. My Installer folder is just 125MB.
There is a M$ tool to show up orphaned Installer files [those not registered] for you to delete; perhaps you could give it a try?
http://support.microsoft.com/default.aspx?scid=kb;en-us;290301
Run :
msizap.exe G
"And if messing with the registry to switch back to DMA"... try the BIOS selection first. And you do not need to directly edit your registry - use Device Manager to set your IDE drives to DMA if available. Look under IDE ATA controllersproperties.
A site for you: http://winhlp.com/node/10
What was using java?

About the only difference between a restart and a start after a shutdown is that the power supply does not get cycled. MB, mem, cpu... all retain power. Software-wise, everything stops and starts anew.
Where exactly in the startup cycle is the extra time being taken? Try running procmon.exe [from winternals] - enable boot logging, reset the filters, and restart the machine. Examine each type of activity [reg , file, network, process ]. See where the time goes.
Malware staying live in memory...? I don't know... try Autoruns from winternals. Run gmer.exe to check for rootkits.
You leave open a lot of possibilities.
http://technet.microsoft.com/en-au/sysinternals/default.aspx
[chkdsk pretty much announces itself when it runs]

No.. no... don't reinstall. Look, all that needs changing is the MBR... it is in a newer format [GUID]so that it can record larger partition sizes. They are instead listed in the GPT [GUID partition table]. The MBR lies on disk outside of and before any partitions, which are unaffected by this. So no need to reinstall, just change the MBR to one XP can work with.

On your XP cd there is a folder named Support. Use dskprobe.exe that is contained within. Else use another XP installation to modify the disk mbr with Testdisk.
fixmbr will not do the job - it only rewrites the first 440 bytes of MBR code; it does not alter the partition table entries. Which is why it is so fast, it does not scan the disk for partitions.

My understanding is that XP does not recognise the GUID disk format.. ie cannot read the GPT.. W7 & and vista can. So i do not see that disk mgmnt can do it. But diskpart can.

I don't know AMD architecture much, but the common point here is the northbridge... AMD have integrated both south and north functions [6100 and 430 chipsets] into the one chip.
The 6100 is graphics and PCI-E, the 430 handles media interfaces, PCI. Transfers with cd/dvd drives are not very bandwidth intensive cf a hdd, but the little bit of extra activity may be overheating the chip. Unclip its heatsink, check the paste [it may be that hard setting stuff, and that is just fine right up until the heatsink gets disturbed by a knock] - put some good non-setting paste on.
If the contact is poor no amount of blowing will cool the chip itself. And the stock heatsink is almost not there.

Okay, got that; you definitely have file trouble on your hdd. If you know how to burn images to cd you can get a Recovery Console iso file from here: http://www.thecomputerparamedic.com/files/rc.iso
...else go to this page for instruction and links : http://www.bleepingcomputer.com/forums/topic276527.html
Don't be concerned about whether the cd image is SP2 or SP3 - it does NOT matter. Updated RC files are important only if you are installing the RC to your hard drive, and you are not doing that with this iso.
Burn that cd, run chkdsk /p
Be mindful that a bad software update can also do this..... but you can tell me if you did any updates in your last good session... eg. M$ security..
Good luck.

If your kb/mouse worked in BIOS etc, stopped when Windows loaded, then it was a driver problem. And the best way to fix that on an inoperative sys is to run windows Repair. That is what it is for. Shame it forces you to dl all the updates again. And often some software must be reinstalled.

Within 5 or so secs of power On BIOS should be addressing the hard disk.... the hdd lamp should flash intermittently, you should hear the head motor twitching. If not, it is a mainboard or RAM problem. I see you checked RAM seating; it may be time to borrow a stick from your local repair shop or dealer. The local nerd will have a selection. Keep to PC2700 SDRAM.
If yes, then I suspect the graphics card.
You might try unplugging the hdd and trying to boot - it will not get far, of course, but if it was the hdd pulling the sys down you would at least see/hear some errors. But my money would be on the RAM. It does die, and when it does nothing happens.

Try to enter Safe Mode; if it will not then use your XP installation cd to run the Recovery Console. In safe mode, run
chkdsk /f
Or, in Recovery Console run
chkdsk /p

I assume that since that model comes with a graphics card as standard that there is no mb integrated graphics, and thus no graphics port on the mb itself to try?
Okay... perhaps BIOS is not starting. Try resetting it to defaults - to do this remove the CMOS battery and replace it after about 5 mins; your guide may tell you of a shorting link to place temporarily in another socket instead. The CMOS battery is about 20mm in diameter. Please turn off and disconnect power to the machine first.
Check again power supply connection to the mainboard.

That is just the way M$ denotes those drives. Using M$'s definitions, the "booting" files are on the System drive; system [OS] files are on their Boot drive. Nobody knows....
If booting and system files are on the same drive [volume] then that volume is denoted System.
Use diskpart to render D: inactive. No sense BIOS getting confused about that one.
I do not thik there is any registry key associated with booting; remember that at this stage in loading an OS it is only the BIOS controlling the action, and then handing control seduentially to files on the drive. The registry comes a good deal later in the process.
My boot and sys files are on C:. I have the main paging file [2 GB] on a second disk but also a small [50MB] one on C:. It should speed things up that way, cut disk access to the second somewhat. I think. Anyway, monitoring their activity shows the C: file gets used to capacity quite often