[Maulik]

I Been getting this 16 bit ms dos susystem error which states that C:/DOCUME~1/BALDEV/LOCALS~1/TEMP/. A Temporary file need for initialization could not be created or could not be written to. Make sure that the directory path exists, and disk space is available. Choose 'Close' to terminate appication.
I get this error when i try to install some games or try to run a program called PC DOCTOR for WINDOWS XP. So can someone Plz help me.. I have talked to Keith about this and he told me to do this:

Click start, all programmes, accessories, system tools to run disc clean up, click more options then clean up restore points, click confirm, click OK. Then from system tools, run disc defragmenter.

Click start then run, type prefetch then press enter, click edit then select all, right click any file then click delete, confirm delete

Click start then run, type sfc /scannow then press enter, you will need the XP CD

System File Check will display an onscreen blue progress bar, when the bar goes, reboot.

Click start then run, type chkdsk /f /r then press enter, type Y to confirm for next boot, press enter then reboot.

Windows will appear to load normally then either the monitor will show progress or the screen will go blank, do not disturb this. This will take an hour or so before it gets to the desktop.

Still no help so he told me to post a Hijack this log here and see what happens. I have posted here many times with the same topic with no response so if anyone can help me, ill appreciate it.
Thanks heres the log::

Logfile of HijackThis v1.99.1
Scan saved at 12:49:40 PM, on 2/26/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Baldev\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapp.../search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapp...//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapp...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:24491;
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions present
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg...t/c381/chat.cab
O16 - DPF: Yahoo! Chat 1.3 - http://cs5.chat.sc5....m/c174/chat.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.t...all/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewid...oOnlineScan.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.c...nst20040510.cab
O16 - DPF: {4B9F2C37-C0CF-42BC-BB2D-DCFA8B25CABF} - http://zone.msn.com/...pcaploader1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1093384941640
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} - http://us.games2.yim...ctl_0_0_0_1.ocx
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1125024449640
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://housecall65.t...ivex/hcImpl.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {7ED7005B-4AF6-4CFF-9AE0-F243C4B8260F} - http://de.trendmicro...eCallButton.CAB
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} - http://www.installen...gine/isetup.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697519} (NsvPlayX Control) - http://www.nullsoft....ayx_vp6_aac.cab
O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://download.game...e/gpcontrol.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://download.game...aploader_v6.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} - http://fdl.msn.com/z...s/heartbeat.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} - https://www-secure.s.../ActiveData.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = DEEMPAL
O17 - HKLM\Software\..\Telephony: DomainName = DEEMPAL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\SYSTEM32\YPCSER~1.EXE


Thank you,
Maulik

[Advertisements]

Run a scan in HijackThis. Check each of the following if they still exist and hit 'Fix Checked' after you check the last one:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapp.../search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapp...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapp...//www.yahoo.com

That error should be easy to fix...

Just copy autoexec.nt from the C:\WINDOWS\repair folder to C:\WINDOWS\system32 folder. That should do it

Your log is clean.

To help prevent future spyware infections, read the Anti-Spyware Tutorial and use the tools provided.

Are there any problems now? If not, you should be set to go.

[greyknight17]

Run a scan in HijackThis. Check each of the following if they still exist and hit 'Fix Checked' after you check the last one:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapp.../search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapp...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapp...//www.yahoo.com

That error should be easy to fix...

Just copy autoexec.nt from the C:\WINDOWS\repair folder to C:\WINDOWS\system32 folder. That should do it

Your log is clean.

To help prevent future spyware infections, read the Anti-Spyware Tutorial and use the tools provided.

Are there any problems now? If not, you should be set to go.

[Maulik]

Hi greyknight17
Thanks for the reply.
Sorry to say but the problem still persist after i copied copy autoexec.nt from the C:\WINDOWS\repair folder to C:\WINDOWS\system32 folder and fixed those R1 hijack this stuff..

Any more suggestions.

Maulik

[greyknight17]

Not sure if you tried these already, but download this file or this one (hopefully they are different files) and see if one of them works.

Are those games you are installing very old games?

See if emptying the temp folders will help:

Download CleanUp! http://cleanup.stevengould.org/ (Alternate Link if main link don't work - http://www.greyknigh...spy/CleanUp.exe ) and install it. CleanUp! deletes EVERYTHING out of your temp/temporary folders, it does not make backups. If you have any documents or programs that are saved in any Temporary Folders, make a backup of these before running CleanUp!. Run CleanUp! and click on the Options button. Uncheck 'Scan local drives for temporary files'. Also uncheck those two Newsgroup entries if you don't want to delete them. Click OK and then click on the CleanUp! button. Let it run. After it's done, choose Yes to logoff.

[Maulik]

I have downloaded those dos file before but there is no success. The games that i am trying to install are recently developed life half life 2. I also ran clean up and the problem persists. i been trying to install a printer driver and all it does it bring up this error.

unique problem huh?

Maulik

[greyknight17]

There are like 10 different versions of this fix...try one more out...this one to see if it helps.

Is it ok if you do a Windows repair? It should restore order to the system and your data files should remain intact (we still recommend backing them up though, you never know what can happen). If you want, to do this, tell us. This is probably your best bet.

If not, we'll run need to run some scans which may take more time than doing the repair

[Maulik]

I am not sure what u mean by windows repair.... if you can explain that a bit more

[greyknight17]

Sure, no problem. What I wanted you to do is basically reinstall Windows on top of itself again. It should keep all your data intact like I said (but backup anyway, to be safe). It will restore all the core component files in Windows and it should fix the 16 bit msdos error.

See this site for step by step information on how to do the Windows repair.

[Maulik]

Sorry to say that i do not have the retail Microsoft Xp cd. so i believe that i will not b able to do that.

the other option was for me to do some scan...what type.

Maulik

Edited by Maulik, 26 February 2006 - 09:42 PM.

[greyknight17]

Hate to do this (I know you posted there already...) but this is more a Windows issue than malware and probably best if you go back to that board. Where is your Windows XP CD? It's very crucial that you put that CD in a safe place just in case you need it...

[Maulik]

I had bought this computer from a show model and a store for a cheap price. i came as is with no box or cd's. at that time i needed a computer and couldnt spend too much money, as for all the computer where expensive. So i never got a recovery cd or XP CD....i also wanted to say that my xp edition is MICROSOFT XP WHISTLERS EDITION, Not home or pro. but yea.

So how should i post it back in the windows board, cuz every time i put it there, keith tells me to come back here.


Thanks a million for your help tho greyknight17, i appreciate it.

Maulik

[greyknight17]

OK, hold on...

I'll ask other experts on this to make sure it's not a malware issue...which I don't think is the case.

I'll post back when I get more info on this.

[Maulik]

thanks

[greyknight17]

Is this a computer company and if it is, is DEEMPAL the domain it's joined in?

Go to Start->Run and type in notepad and hit OK. Then copy and paste the following into Notepad:

regedit /a report.txt "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\VirtualDeviceDrivers"
if not exist %windir%\system32\AUTOEXEC.NT echo %windir%\system32\AUTOEXEC.NT not there>>report.txt
if not exist %windir%\system32\Config.nt echo %windir%\system32\Config.nt not there>>report.txt
if not exist %windir%\system32\Command.com echo %windir%\system32\Command.com not there>>report.txt
if not exist %windir%\repair\autoexec.nt echo %windir%\repair\autoexec.nt not there>>report.txt
if not exist %windir%\repair\Config.nt echo %windir%\repair\Config.nt not present>>report.txt
notepad report.txt
del report.txt
del delete.bat

Save the file as "delete.bat". Make sure to save it with the quotes. Double click on it to run it. A notepad file should open up. Post it here.

[Maulik]

If you ment if it the computer belongs to a company then no. Deempal is my network work group name that my netowrker had down for me. Deempal is actually my sisters name.

Here is wat the notepad gave me;

REGEDIT4

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\VirtualDeviceDrivers]
"VDD"=hex(7):00