[marcoltd]

hi,

i once removed a program and ever since, the registration page comes up everytime i turn on the laptop, even before windows is up and running. the operating system is xp home edition. what is worse i can't remember the name of the program in order to identify it. it causes no problems other than i have to click ok and wait sometime for windows to appear.

the problem happens about three second after i turn on the laptop. so i can't give you a screen shot. it is qiute a basic, vb screen with an ok button for continuation. once you do that a full screen command promt comes up with<home> on it, if you press the home key you entre another vb asking for the password. then the laptop hangs, best not to press the home key. then windows loads normally.

on shuting down my laptop i get an end program box with sample as a title.

the only info i can find is that the program may have been written in delphi and aparently even though the main program was uninstalled it can leave traces ie registration prompts.

regards

marcoltd

[Advertisements]

Hey there marcoltd, welcome to Geeks To Go... I am Spike and I will be assisting you today.

I am assuming that you can still access your laptop and work on it with our being interrupted. Once you have finished going through the registration prompts and your desktop is normally in windows.

Goto:
> Start
> Run
> Type in "msconfig"
> Goto the "Startup" tab

There is a list of programs there, would you please type them out for me or maybe take a screen shot so I can see whats starting up with windows.

> Then goto the "Services" tab

This time, select the check box (Hide All Microsoft Services) and type the values that's left or take a screenshot. Then please post them in your next post.

NOTE: Please do not attempt to remove any programs already running, as this may cause some programs not to function properly.

Goto:
> Start
> Run
> Type in "sysedit"

When the window opens up, please copy and paste the contents of the child window "AUTOEXEC.BAT" and "CONFIG.SYS" in your next reply.

That is all I'll be needing for now... The reason I have asked you to do this, is so that we can identify the program that keeps starting up with windows.

Also if you recognize any of the programs that you post through to me, let me know about it. And DO NOT remove it yourself as there still might be entries that's left behind. (We want to get it off properly this time )

Cool

[Spike]

Hey there marcoltd, welcome to Geeks To Go... I am Spike and I will be assisting you today.

I am assuming that you can still access your laptop and work on it with our being interrupted. Once you have finished going through the registration prompts and your desktop is normally in windows.

Goto:
> Start
> Run
> Type in "msconfig"
> Goto the "Startup" tab

There is a list of programs there, would you please type them out for me or maybe take a screen shot so I can see whats starting up with windows.

> Then goto the "Services" tab

This time, select the check box (Hide All Microsoft Services) and type the values that's left or take a screenshot. Then please post them in your next post.

NOTE: Please do not attempt to remove any programs already running, as this may cause some programs not to function properly.

Goto:
> Start
> Run
> Type in "sysedit"

When the window opens up, please copy and paste the contents of the child window "AUTOEXEC.BAT" and "CONFIG.SYS" in your next reply.

That is all I'll be needing for now... The reason I have asked you to do this, is so that we can identify the program that keeps starting up with windows.

Also if you recognize any of the programs that you post through to me, let me know about it. And DO NOT remove it yourself as there still might be entries that's left behind. (We want to get it off properly this time )

Cool

[marcoltd]

hi spike,

sorry it took so long to get back. this is the stuff you asked me for

there is no info in the autoexec.bat or in config.sys. there is the following in c:widows\sytem.ini

; for 16-bit app support
[drivers]
wave=mmdrv.dll
timer=timer.drv
[mci]
[driver32]
[386enh]
woafont=dosapp.FON
EGA80WOA.FON=EGA80WOA.FON
EGA40WOA.FON=EGA40WOA.FON
CGA80WOA.FON=CGA80WOA.FON
CGA40WOA.FON=CGA40WOA.FON

and this in c:windows\win.ini

; for 16-bit app support
[fonts]
[extensions]
[mci extensions]
[files]
[Mail]
MAPI=1
CMCDLLNAME32=mapi32.dll
CMC=1
MAPIX=1
MAPIXVER=1.0.0.1
OLEMessaging=1
[MCI Extensions.BAK]
aif=MPEGVideo
aifc=MPEGVideo
aiff=MPEGVideo
asf=MPEGVideo
asx=MPEGVideo
au=MPEGVideo
m1v=MPEGVideo
m2v=MPEGVideo
m3u=MPEGVideo
mod=MPEGVideo
mp2=MPEGVideo
mp2v=MPEGVideo
mp3=MPEGVideo
mpa=MPEGVideo
mpe=MPEGVideo
mpeg=MPEGVideo
mpg=MPEGVideo
mpv2=MPEGVideo
snd=MPEGVideo
wax=MPEGVideo
wm=MPEGVideo
wma=MPEGVideo
wmv=MPEGVideo
wmx=MPEGVideo
wpl=MPEGVideo
wvx=MPEGVideo
[IRIS_IPE]
menu=1

this is the rest

Visit My Website

Edited by marcoltd, 03 October 2008 - 08:33 AM.

[Spike]

Excuse me!!! I mistook the link as an advert...

Please be patient while I am look over the stuff.

Cool

Edited by spike_hacker_inc, 03 October 2008 - 08:52 AM.

[Spike]

Hey again marcoltd. Sorry for the long wait...

I once again I have to ask for some more information. I couldn't retrieve enough info from the screen shots to tell what should or should not be running.


Cool

[marcoltd]

hey spike,

[Spike]

Reason for edit: removed malware advice
Reason for edit: removed log

Hey again marcoltd... If you noticed the log was removed by a mod, but I have spoken to the mod and with his permission am able to still post a fix through. I have your log that was removed so there is no need to post through a new one, just be patient as I am revising a fix!

Cool

[marcoltd]

hey spike,

sorry i don't understand why the last post was removed?

marcoltd

[Spike]

hey spike,

sorry i don't understand why the last post was removed?

I am not fully capable of removing malware and the log that you sent to me is usually for the removal of malware. If the program is used incorrectly, it can cause more damage than good! So the moderator removed the log to avoid me trying to assist you. (Because I am not certified to work with logs and to protect you from me maybe messing up your PC) BUT This is not a malware case and I have received permission to continue with the fix from certified mods, I assure you that you are in good hands!

On with the fix... I did not find any bad entries in the log, but I have found some suspicious start up's. So we will remove these from the startup:

Goto:
> Start
> Run
> Type in "msconfig"
> Goto the "Services" tab

Check the box called "Hide All Microsoft Services" and deselect the entries listed below:

Autodesk Licensing Service
FLEXnet Licensing Service
InstallDriver Table Manager
Microsoft Office Groove Audit Service
EService
EServiceNT
EServiceNT1

Removing these entries will not cause any harm to your computer and if needed we can re-enable them... The only entries I am suspicious of is, which I can find very little information about:

EService
EServiceNT
EServiceNT1

Located under:

C:\HiRestore_SW_Client\
C:\HiRestore SW\

Please if these entries ring a bell or your recognize them , let me know.

After unchecking those entries, click "Apply" and restart your computer. When your PC starts up again you will see a message box like this:



Just check the "Don't show this message...." and click "OK".

Please tell me if that stuff is still coming up when your started windows and if everything is working like it did before. Also notify me if you have any other problems.

If our fix worked then that stuff you didn't want, shouldn't start up with windows. So just let me know if it worked or not...

Cool

[marcoltd]

hi spike,

did as you asked, unfortunately it did not remove the problem. i have done a searchand manually looked up C:\HiRestore_SW_Client\
C:\HiRestore SW\

and they are not on my system!

regards

marcoltd

Edited by marcoltd, 05 October 2008 - 03:34 PM.

[Spike]

Mmmmm, weird!

OK, I am going to ask you to do some last things! If they still do not work I am gonna advise you to goto the malware forum.

Goto:
> Start
> Run
> Type in "msconfig"
> Goto the "Services" tab

Check the box called "Hide All Microsoft Services" and then uncheck ALL the other entries!

EXCEPT for:

France Telecom Routing Table Service

Then goto the "Startup" tab and unselect ALL entries except for:

SystrayApp
SessionManager

Restart your computer and let me know what happens... If the problem carries on, then open MSCONFIG again. BUT this time CHECK all of them so that it is back to its original state like it was before we started the fix.

For now just let me know if it works, if it doesn't I suspect malware because it seems when we remove a startup entry it re-adds itself. Of course it may NOT be that... The log that i requested does not show me all the information that I may need and therefor you will need to post a proper log to a certified malware staff to check into your problem more in depth. But let me know what happens first and I will give you further instructions.

I am sorry I could not help and fix your problem from the first attempt, problems like these maybe be so small that they are overlooked and some just take alot of time. To assure you, if you are requested to goto the malware forum and your log does come up clean. Then you will be requested to come back here and I will be more than happy to continue to help you! I just need to know for now that we are definitely not working with a malware case.

Cool

[Artellos]

Hello there marco and spike_hacker_inc,

I hope you don't mind me dropping in.
I would just like to refer to the topic marco started on 247fixes here.
the more eyes on this the better. Though there's already quite a lot that I tried.
Feel free to read / reference from that post

Regards,
Olrik

[marcoltd]

hi olrik and spike,

spike if you don't know orlik, now's your chance he is a very clever person, gave me lots of help. we have struggled to find the solution for this problem and the only thing we can come up with is to repair windows. i'am cosidering this as a last resort. i can live with the problem for the time being. i'm sure the answer is out there somewhere.

regards

marcoltd

[Artellos]

Hey marco,

I've had a few other techies look at the logs I requested from you over at the other forum and he found that the FIPS drivers aren't functioning properly.
I'll quote his post.

If you wade into the WinAudit Report far enough, you'll find the System Error reports from Event Viewer. They indicate that the boot-time FIPS drivers aren't loading because they are missing or corrupt...this would definitely cause some serious hissy fits to be thrown by the computer. The only reliable way I know of to resolve the FIPS issue is by either a repair installation or re-installation of Windows.

I think the Windows Repair is a necessary step at this point.
Remember that a windows repair does NOT let you loose any data.

Regards,
Olrik

[marcoltd]

hi olrik,

i'll dig out my xp disc and follow the instuctions you gave me. i'll keep you posted

regards

marco