ME - Registry Corruption

[kerridc]

I initiated this question in the wrong place. Following is my response to questions posed back to me and the recommendation to post here. In short, I have corrupted my registry and lack knowledge to edit it back into a usable state.

"Back to your problem:
You can get a dos prompt in ME, but you need a boot disk.
Since you still have access to parts of Windows, go to Add/Remove Programs and then click the tab for startup disc."
I cannot get Add/Remove Programs to respond - error = Windows cannot access the specified device, path or file. You may not have the appropriate permissions to access the item.


"But, you alluded to a boot disc earlier which gave you an error.
Was it a Win98 boot disk?"
No, I obtained a boot disk from bootdisk.com for Windows ME. It errored out upon bootup saying that the file was an invalid format.

"Also, it would help if you let us know how you "hosed" the registry.
Then, we may be able to help more."
Prepare to giggle. I went into the registry and located several files which I suspected might be the triggers for the viruses I've been unable to kill [a Swen variation, Javaabyte, mime-gen]. These are the keys listed in the "FixSwen" standalone utility. The syntax is;

HKCR, "batfile\shell\open\command",,0,"""%1"" %*"
HKCR, "comfile\shell\open\command",,0,"""%1"" %*"
HKCR, "exefile\shell\open\command",,0,"""%1"" %*"
HKCR, "piffile\shell\open\command",,0,"""%1"" %*"
HKCR, "regfile\shell\open\command",,0,"regedit.exe "%1""
HKCR, "scrfile\shell\open\command",,0,"""%1"" %*"
HKCR, "scrfile\shell\config\command",,0,"""%1"" %*"

I went into each key and added the word "virus" in front of the % sign thinking it would be easy to locate them quickly later if they weren't the virus culprits and I needed to change them back. It didn't occur to me I would hose the registry. My bad.


"Also, you say hosed access to all youir executable files.
That is not the case if you can still run some programs and access the internet."

Correct. This is where it painfully shows that a little knowledge is a dangerous thing. In fact I have since discovered that if I do a search for a document [.doc] and double-click it, Word will indeed initiate with no problem. Also I can double-click a desk-top icon. However if I try to double-click in other areas I typically get the same error message as above.

For example I can access nothing from my control panel. This initially caused me to believe I had completely hosed all my .exe's. I also cannot right-click / properties from the "my computer" icon. I cannot call up regedit.

Another error example; when attempting to start IE [6.0] I get - Windows cannot find 'C:\\Windows\Explorer.exe'. You may have typed the name incorrectly in the Run dialog, or another open program cannot find a system file. To search for a file, click the Start button, and then click Search.

I'm afraid I'm not certain exactly what I have and haven't hosed.


"You also say: " I've tried the system restore disks from Compaq - more errors and failure to restore."
Well that is another and different problem entirely.
What were the error messages?
Why would it not restore?"
I attempted to take the disk recommendation; to create a system backup prior to doing a restore. In both attempts after about 30 minutes the error message appeared "unable to write to image file." I then had to escape out of that and re-boot. I don't know why this error was triggered. I stopped short of doing a format without backup.


"Do you want to do a format/restore or do you want to recover what you presently have?"
I'm trying to exhaust every option before doing a format/restore. I can re-install all my apps, but I stand to lose a significant volume of e-mails and potentially other data that I would much rather keep.

"Until you let us know, we can not help you without this info.[/QUOTE]"
I didn't want to drone on about these things until I thought it was appropriate to do so. I would truly appreciate any information you can offer.

thanks-kerri

[TripleRLtd]

Alright.
Good ker, and again, welcome to Windrivers.
But, now that you have posted in the right place, we still have this BIG problem.
You may have heard techs talk about "corrupted windows" way too much.
Well, in this case, that is exacty what you have.
Almost always, you can fix it.
In my experience, ME is best when starting over.
Do you know that you can deltree the Windows folder and then reinstall?
That, at least allows you to save your data.
But first, what started this whole scenario?
What virus was it?
You say Swen +, but I have not seen this type of damage to windoze, but then again, it is ME.
See the following:
http://[email protected]
The other two I can't find anything on. (spelling?)
Right now, I think, the best bet would be to get into windows and save the data you need.
Then, do a full restore.
But, I am not sure what you mean by:

I attempted to take the disk recommendation; to create a system backup prior to doing a restore. In both attempts after about 30 minutes the error message appeared "unable to write to image file." I then had to escape out of that and re-boot. I don't know why this error was triggered. I stopped short of doing a format without backup.

What image file are we talking about?
Where are you trying to back up to and with what?
Anyway, this is what I recommend:
Wait till morning, and more Windrivers techs weight in on this problem, then proceed.

[NooNoo]

Morning Kerri

A ME and a little knowledge leads to either the impossible being done with the improbable or a right royal.....

OK - so from your post the first order of business is to save your data.... bug infected or not, right?

So first question, what tools do you have at your disposal? A cd writer? DVD writer? Another computer?
Another hard drive?

You need to copy the stuff in the state it is in and then start thinking about sorting it out.

If you have a cdrw/dvdrw and a program called ghost or similar we are in business, because you can ghost the entire partition and then open the image on another machine.

If you have another hard drive, then you can put the other hard drive as master, run your compaq restore cd's (hopefully) and then access the 2nd hard drive for cleaning it.... NOTE do not add infected hard drive until your new hard drive is ready with windows AND A GOOD VIRUS CHECKER.

If you have another computer, then put a good virus checker on it and then add the infected hard drive and again clean it up from there.

Making the old hard drive usable is the goal, and that cannot happen until all viral activity has been eliminated.

[kerridc]

"OK - so from your post the first order of business is to save your data.... bug infected or not, right?"

YES

"So first question, what tools do you have at your disposal? A cd writer? DVD writer? Another computer? Another hard drive?"

I have both a CD and DVD writer, but I'm unable to access either one.


"If you have a cdrw/dvdrw and a program called ghost or similar we are in business, because you can ghost the entire partition and then open the image on another machine."

I don't have Ghost or similar. So far I have not been able to download anything and successfully open / run it.


"If you have another hard drive, then you can put the other hard drive as master, run your compaq restore cd's (hopefully) and then access the 2nd hard drive for cleaning it.... NOTE do not add infected hard drive until your new hard drive is ready with windows AND A GOOD VIRUS CHECKER."

No other hard drive. I had 'a good virus checker' or so alleged - Mcafee. I incurred the first virus almost immediately after installing the Spamkiller program they offer. None of their fixes, stand-alone utilities or anything else could successfully rid the virus. I have since discontinued Mcafee. I now have PC-Cillin from Trend Micro. I hope they are a little more reliable. I also have a LinkSys box serving as a firewall.


"Making the old hard drive usable is the goal, and that cannot happen until all viral activity has been eliminated."

I feel cautiously hopeful about handling the virus if I can just access my drive correctly. In 10 years I have never not been able to eventually work my way out of a virus. I'll be damned if it happens now.

Original virus = "32Swen@MM" as I recall. Then came "Exploit-MIME.GEN.exe." Then came something called "JAVAAByte." Then came something with "slime" in the title. These have been successfully cleaned by PC-Cillin, but I have not been able to stop the regeneration. And yes, I have disabled the system restore feature approximately 2 weeks ago.

[kerridc]

SUCCESS!!

A friend of mine came up with a generic boot disk that worked. I was able to restore the registry from there.

THANKS to everyone for working with my question and being encouraging.

kerri

[NooNoo]

Try this - will it go to safemode at all?

[NooNoo]

Duh, too late... glad its fixed!

[TripleRLtd]

BUT WAIT!!!

Yes, it may be fixed, and that is great, but what do you mean by " a generic boot disk" that allowed you to fix this problem????
What is this disk, and what did you do?
Help us as we have helped you.
Geez, so many questions go unanswered.
I give you much credit NooNoo for dealing with this stuff for soooo long.
People who never get back to you.
People who find fixes and don't say what they were.
People who just disappear.
What,exactly, solved the problem.
Generic boot disk fix only leads to more questions!!!!