[pedrossi]

Hi,

I'm still running Service Pack 1 (yes, I know, shame on me ) so I finally decided to go install SP2 on my outdated machine. However, I've been running into some problems updating it, and contacted HP about it (Microsoft told me to go to HP because my Windows is OEM). They sent me some instructions telling me to do some Registry things by typing in 'regedit' in Start > Run. But when I type in 'regedit', I get the following error message:



I googled the DLL file name and found a download for it. I created a Symantec folder and threw the file in there, and while this isn't really fixing anything it did get rid of that error message. Now, when I type in 'regedit', I get this error message instead:



Clicking 'ignore' several times brings the message up again.
HP said this is being caused by a virus or spyware. I bought the latest version of McAfee and ran a complete scan yesterday. Quarentined a few items and deleted a few. I also got SpyBot Search & Destroy yesterday and ran a scan with that, apparently fixed all issues it found.

I downloaded a tool from Symantec to remove all Norton-related software from my PC. After running that tool, I still get the first error message if that S32EVNT1.DLL file isn't in that Symantec folder that's not even supposed to exist.


Knowing this, I decided it's probably something to do with my registry. But as I can't get through to the registry, I downloaded a tool called Registry Booster. That tool scanned my registry and found about 1200 problematic entries. It wants me to pay $40 for it to remove them all, but I thought I'd wait and see what you guys think.

What should I do about this problem? It's getting pretty annoying and I spent about all day yesterday trying to fix it

Thanks in advance for the help

[Advertisements]

Hi pedrossi...

The first thing I notice is the regedit.com error...regedit is an .exe not a .com. You have an association problem somewhere. Let's take these on one at a time.

Click Start, then Run, type regedit.exe and click "Ok". Does Registry Editor open this way?

wannabe1

[wannabe1]

Hi pedrossi...

The first thing I notice is the regedit.com error...regedit is an .exe not a .com. You have an association problem somewhere. Let's take these on one at a time.

Click Start, then Run, type regedit.exe and click "Ok". Does Registry Editor open this way?

wannabe1

[pedrossi]

Hey Wannabe1,

Yes, the regedit did open now, thanks!

What's next?

[wannabe1]

In the left pane, expand (click +) HKEY_LOCAL_MACHINE, then SOFTWARE, then Microsoft, then Windows NT, then CurrentVersion, and click on Winlogon.

In the right pane, scroll down to Shell. What is the value shown under the Data column?

[pedrossi]

the value is 'Explorer.exe'

Edited by pedrossi, 23 December 2006 - 02:01 PM.

[wannabe1]

That one's correct. collapse that key by click the minus signs by the open folders.

Expand HKEY_CLASSES_ROOT and click on .exe

The values in the right pane for this key should be as follows:

(Default) = exefile

Content Type = application/x-msdownload

Is this what you find?

[pedrossi]

yep that's exactly what it shows

[wannabe1]

Let's see if regedit.com is on the machine. If it is, we'll get rid of it...but, this file is usually put in place by malware. We're probably going to have to run you through the malware forum before we can properly fix this.

Click Start, then Run, type %windir% and click "Ok". See if you can find the application icon for regedit.com. Or if you find two icons named regedit (no file extension), check the properties of each by holding the mouse pointer over them.

Is regedit.com present?

[pedrossi]

The only regedit I see in that folder is regedit.exe, but there is no regedit.com (including hidden files)

[wannabe1]

Back to Registry Editor.

Expand HKEY_CLASSES_ROOT,then exefile, then shell, then open, and click on command.

What is the value given for (Default)?

[pedrossi]

(Default) = "%1"%*

[wannabe1]

Is there an entry listed there with a value, but no name?

[pedrossi]

nope :-/

[wannabe1]

I'd be willing to bet this is a virus...

I'm going to have you post a log in the malware forum and see if we can verify that one way or the other.

Please go to the Malware Forum and follow the instructions found there.

That will give you several steps that will help you clean up 70 percent of all problems by yourself...then post a hijackthis log in THAT forum. Be patient, the Malware Forum is a very busy place and a two or three day wait is not unusual. DO NOT REPLY TO OR BUMP YOUR OWN LOG. If it shows a reply it may be overlooked as one that is being worked on.

If you are still having problems after getting a clean bill of health from the malware expert, please return to this thread.

[pedrossi]

will do. Thanks for the help