[brookseegirl]

This morning, all my Word documents and portions of my programs were in symbols instead of the usual font. When I went to Internet Options to see if the font had been changed, there were no fonts there at all, only the option for Latin as the language.

In my Windows font file, I have about 6 fonts and in Word, I only have 3 fonts left and they all have symbols.

After spending two hours with HP this afternoon, I finally figured out on my own to just delete the Symbols font which restored things to the way they should look but does not help me to have my fonts back.

Spybot had about 12 registry values pending that needed me to click on the allow change button (the deny change option was not highlighted, so I couldn't deny them). They were all items that were set for deletion and were all numeric so I don't know what they were. I have to wonder if it wasn't my fonts being taken away. I don't know enough about registry values to make an informed guess about that.

Please help me if you can. I've scanned with multiple spyware scanners, Symantec Anti-Virus, plus I have two firewalls that should have prevented this.

I can't use system restore because it had somehow been disabled and the last time it worked was last September!

Edited by brookseegirl, 01 May 2005 - 08:43 PM.

[Advertisements]

...the fact that the fonts disappeared should be the first concern....please run a scandisk on the affected drive.

As for replacing the fonts, do you have a windows cd?

[gerryf]

...the fact that the fonts disappeared should be the first concern....please run a scandisk on the affected drive.

As for replacing the fonts, do you have a windows cd?

[brookseegirl]

Actually, I investigated further into my Norton Antivirus history event log. Even though it was not showing up at all in the scan log, I have a virus and my computer has been fighting every 5 seconds since 3/8/05. It's in a hidden file in C: called _RESTORE.

What to do about it? I don't know. The files all are inaccessible. You can see them but no matter what you try to do, the message pops up stating that the path can't be found.

If you have any info, I'd appreciate the help greatly. From all I can tell, it may have come through when I downloaded Mozilla Firefox. There were several files beginning _CACHE from that date associated with Mozilla. That is also when I installed it. I've deleted those files but this thing is so far gone now that I don't really know what to do.

[gerryf]

Antivirus programs cannot delete viruses in system restore points...but they are not infecting your machine -- they are "trapped" within the restore point unless you run a restore.

In WinME to turn off system restore, do the following:

1. Click Start, Settings, and then click Control Panel.
2. Double-click the System icon. The System Properties dialog box appears.

NOTE: If the System icon is not visible, click "View all Control Panel options" to display it.

3. Click the Performance tab, and then click File System.
4. Click the Troubleshooting tab, and then check Disable System Restore.
5. Click OK. Click Yes, when you are prompted to restart Windows.

Run your Antivirus software scan again

Now restart System Restore

To enable Windows Me System Restore, do the following:

1. Click Start, point to Settings, and then click Control Panel.
2. Double-click System, and then click the Performance tab.
3. Click File System, and then click the Troubleshooting tab.
4. Uncheck Disable System Restore.
5. Click OK. Click Yes, when you are prompted to restart Windows.

[brookseegirl]

Many of the files located by the anti-virus software are password protected so they can't be dealt with. There are 118 files associated with this problem. I can see which files are causing the problem but can't do anything with them.

I even downloaded a new anti-virus software, thinking mine is being inhibited by the virus, but it is also unable to do anything with the files. I tried to manually delete them and, when that failed, to move them. The writers of the virus have made them untouchable.

What is the next step? If I restore the system, will they be gone or is it time to bring in a professional? Or start shopping for a new computer?

Thank you for your advice! It is very helpful!

[gerryf]

That seems hard to believe (files being password protected)....not run into such a virus before.


Give me an example of a file name and it's location

[brookseegirl]

OK. I can't access the ones from the new anti-virus because it didn't keep the log after I closed the window. That program scanned my computer for over 14 hours so I am not going to rerun it. These are the ones that Symantec is unable to open, however. I feel quite certain the first three are definitely related to the virus. You know far more than I do about these things. After taking a look, can you please tell me if you have any idea what type virus I have?

A possibility you might want to ponder is that, suddenly, yesterday, I'm being prompted to give a password for my system at startup. I never created a password because my children use the computer too. We just always click OK and it goes straight to my desktop.

Another oddity is that, as long as I've had the computer, my running programs in the task bar has always shown the volume control on the far left, and everything else moved to the right from there. Since all this started, the volume has been appearing on the far right.

I also keep getting a message saying Hsposm has caused an error in OLEAUT32.dll and that it will now close.

Been getting VxD Blue screens for a couple of months too talking about stack problems. It appears in my Symantec log, that it has been trying to access these files and combat them since 3/8/05.

That's all the extra info I can think of at this time.

The reason I'm avoiding restoring the computer for so long is that it had been disabled and the most recent restore point is last September. I have my personal things on disc but I'll lose my RoadRunner and I'd rather take a beating than wait for the cable company to get around to reinstalling it! I had my home phone disconnected when it was installed so I have no other internet access without it!

These are the files that can't be moved, deleted, etc. These files all contained the message listed below:

Scan could not access path


C:\_RESTORE\TEMP\7_-_@_V_.(`T
C:\_RESTORE\TEMP\__-_(`T_.-ÅV
C:\_RESTORE\TEMP\@_V_-`T_.(`T
C:\WINDOWS\Internet Logs\HPPAV.ldb
C:\WINDOWS\Internet Logs\IAMDB.RDB
C:\WINDOWS\Internet Logs\tvDebug.log
C:\WINDOWS\Temporary Internet Files\Content.IE5\index.dat
C:\WINDOWS\Sti_Event.log
C:\WINDOWS\Desktop\EZArmor_RR.exe due to extraction errors encountered by the Decomposer
C:\WINDOWS\Application Data\Microsoft\Internet Explorer\MSIMGSIZ.DAT
C:\WINDOWS\SchedLog.Txt
C:\WINDOWS\WIN386.SWP
C:\WINDOWS\All Users\Application Data\Symantec\Common Client\Restrict.log
C:\WINDOWS\All Users\Application Data\Symantec\Common Client\Privacy.log
C:\WINDOWS\All Users\Application Data\Symantec\Common Client\WebHist.log
C:\WINDOWS\All Users\Application Data\Symantec\Common Client\Content.log
C:\WINDOWS\All Users\Application Data\Symantec\Common Client\Confid.log
C:\WINDOWS\All Users\Application Data\Symantec\Common Client\settings.dat
C:\WINDOWS\History\History.IE5\MSHist012005050420050505\index.dat
C:\WINDOWS\History\History.IE5\index.dat
C:\WINDOWS\Cookies\index.dat
C:\WINDOWS\wiaservc.log
C:\WINDOWS\Sti_Trace.log
C:\WINDOWS\TEMP\JET69A2.TMP
C:\WINDOWS\TEMP\JETE8F0.TMP
C:\WINDOWS\TEMP\_avast4_\Webshlock.txt
C:\WINDOWS\TEMP\ZLT00b6a.TMP
C:\WINDOWS\SYSBCKUP\rbbad.cab due to extraction errors encountered by the Decomposer Engines.
C:\WINDOWS\OPTIONS\CABS\WIN_OL.CAB due to extraction errors encountered by the Decomposer Engines.
C:\WINDOWS\OPTIONS\CABS\WIN_9.CAB due to extraction errors encountered by the Decomposer Engines.
C:\WINDOWS\OPTIONS\CABS\WIN_8.CAB due to extraction errors encountered by the Decomposer Engines.
C:\WINDOWS\OPTIONS\CABS\WIN_21.CAB due to extraction errors encountered by the Decomposer Engines.
C:\WINDOWS\OPTIONS\CABS\WIN_20.CAB due to extraction errors encountered by the Decomposer Engines.
C:\WINDOWS\OPTIONS\CABS\WIN_19.CAB due to extraction errors encountered by the Decomposer Engines.
Could not scan 3 files inside C:\WINDOWS\OPTIONS\CABS\WIN_18.CAB due to extraction errors encountered by the Decomposer Engines.
C:\WINDOWS\OPTIONS\CABS\WIN_17.CAB due to extraction errors encountered by the Decomposer Engines.
C:\WINDOWS\OPTIONS\CABS\WIN_16.CAB due to extraction errors encountered by the Decomposer Engines.
C:\WINDOWS\OPTIONS\CABS\WIN_15.CAB due to extraction errors encountered by the Decomposer Engines.
C:\WINDOWS\OPTIONS\CABS\WIN_14.CAB due to extraction errors encountered by the Decomposer Engines.
C:\WINDOWS\OPTIONS\CABS\WIN_13.CAB due to extraction errors encountered by the Decomposer Engines.
C:\WINDOWS\OPTIONS\CABS\WIN_12.CAB due to extraction errors encountered by the Decomposer Engines.
C:\WINDOWS\OPTIONS\CABS\WIN_11.CAB due to extraction errors encountered by the Decomposer Engines.
C:\WINDOWS\OPTIONS\CABS\WIN_10.CAB due to extraction errors encountered by the Decomposer Engines.
C:\WINDOWS\OPTIONS\CABS\NET3.CAB due to extraction errors encountered by the Decomposer Engines.
C:\WINDOWS\OPTIONS\CABS\DRIVER6.CAB due to extraction errors encountered by the Decomposer Engines.
C:\WINDOWS\OPTIONS\CABS\DRIVER5.CAB due to extraction errors encountered by the Decomposer Engines.
New virus definition file loaded. Version: 70502y.
Manual LiveUpdate successfully downloaded Virus Definitions.
Symantec AntiVirus services startup was successful.

[gerryf]

only the first three are a problem...the rest are either in use or for some reason your AV program cannot access MS Cab archive format....

either way, did you turn OFF system restore as directed in my thread, then run your av program?

take care of that first.....turning it off should allow norton to remove the problem file.

[brookseegirl]

I think the problem may be solved. There has been a minibug transporter on my computer for a couple of months. It was associated with Weather Bug. Symantec never could delete it so I assumed it wasn't too bad and never took the time to persue it since I wasn't having many problems.

That appears to be gone now because I followed it's path several times and deleted, hopefully, all the locations it was in. The last scan (done in the method you'd suggested) didn't pick it up again. My fonts look the way they should for the moment. That doesn't mean they can't change back because I've made them better before.

I'm optimistic, however, because I've rebooted and everything is still okay.

The three files mentioned earlier are not showing up as viruses, just files that cannot be scanned. They still showed up that way this time, as well. Do you think they are files I should be concerned with? If so, please let me know.

Thanks again for your help.

[gerryf]

they probably are of no consequence, but to be honest with you it would bug the heck out of me....

Do this:
1. Click Start, point to Settings, and then click Control Panel.
2. Double-click System, and then click the Performance tab.
3. Click File System, and then click the Troubleshooting tab.
4. Click to select the Disable System Restore check box, click Apply, click to clear the Disable System Restore check box, click Apply, and then click OK.
5. Restart the computer when you are prompted to do so. When the computer restarts, the data store is purged and the System Restore feature begins monitoring the system again.

[brookseegirl]

Well, it is bugging the heck out of me! I had rebooted once when I e-mailed you, thinking that was the test to see if all was well! Everything was still okay. Since then, I've rebooted again and, guess what? IT'S NOT!!!!

The symbols are back and I have only 3 fonts in Word again!

Have you ever seen those files or anything like them before? I scanned again and the minibug is still gone. The problem has got to be in those files. I think it's all related to the C:\_RESTORE files. Or is that a normal directory?

[gerryf]

yes, it is a normal directory.....

did you do what I noted?

[brookseegirl]

Yes, I did what you suggested. I still have a mess on my hands.

What should I try next? (Short of a sledge hammer or gun, the latter being my personal favorite at the moment! But, once again, I'd have to wait for the cable company.....)

[brookseegirl]

Question: Should the "Disable System Restore" option be checked after I rebooted? I left it unchecked and now it is checked.

[gerryf]

yes, it restarts on reboot....are those files still present....again, not the issue with the mess...just one step at a time.

I need to load a copy of WinME ... sometime tonight.

In the meantime, download Tweakui for win9x.

http://www.microsoft...g/NTTweakUI.asp

Install, then

Start > Settings > Control Panel > tweakui...look for the REPAIR tab, select REPAIR FONT FOLDER, then hit apply