[tampabelle]

Please copy the following in a new text file in Notepad and save it as fix.reg (make sure the Save as Type is set to All Files) -

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\7F3915FC73B65D117B2D00AA002A401F]
"ProductIcon"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Money System Pack\10.0\SysMsi]
"LastPackage"=-

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{CF5193F7-6B37-11D5-B7D2-00AA00A204F1}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"c:\\WINDOWS\\Installer\\{CF5193F7-6B37-11D5-B7D2-00AA00A204F1}\\"=-

Double click on fix.reg and let it merge with your registry.

Reboot the PC.

Let me know how it goes

[Advertisements]

Copied contents into file and "allowed to merge to registry". Shut down hung at the same place "Windows shutting down". Powered down and came back in. Windows preparing to install popped in the same place. Tried to remove Money with Tuneup (COntrol panel still doesn;t even give me any options to do anything).
Quits telling me that I need to complete the install. Then trued "re-install" fromt pop up window for remove and get the same message. Complete install in process.
This sucker is worse than a sticky penny on the bottom of my shoe.

Won't let me shut down and won't complete/end install, though it did permit World Wind (NASA), and a windows update to load the other night with your help. I'm so confused......

[scout1]

Copied contents into file and "allowed to merge to registry". Shut down hung at the same place "Windows shutting down". Powered down and came back in. Windows preparing to install popped in the same place. Tried to remove Money with Tuneup (COntrol panel still doesn;t even give me any options to do anything).
Quits telling me that I need to complete the install. Then trued "re-install" fromt pop up window for remove and get the same message. Complete install in process.
This sucker is worse than a sticky penny on the bottom of my shoe.

Won't let me shut down and won't complete/end install, though it did permit World Wind (NASA), and a windows update to load the other night with your help. I'm so confused......

[tampabelle]

Hi Scout1,


Can we try this again -

Step 1
Click on Start ----> Settings ---> Control Panel ---> Administrative Tools ---> Computer Management.

In the left hand pane, click on Application (under Computer Managemetn (Local ---> System Tools ---> Event Viewer). In the right hand pane locate instances of MsiInstaller. It will be of particular use, if you can locate any instance of MsiInstaller with a warning or error notation.

Double click on it and then make a note of the details it provides.

Step 2

double click on regsrch.vbs (you had downloaded this earlier)
(if you have script protection, please allow this to run)

In the dialog that opens enter the following:

CF5193F7-6B37-11D5-B7D2-00AA00A204F1

Press 'OK'

The search will run for a while then alert you when it is finished.

Press 'OK' and copy the contents of the WordPad window and post in this thread.

[scout1]

Event Type: Warning
Event Source: MsiInstaller
Event Category: None
Event ID: 1001
Date: 8/7/2005
Time: 6:22:10 PM
User: NT AUTHORITY\SYSTEM
Computer: YOUR-W92P4BHLZG
Description:
Detection of product '{CF5193F7-6B37-11D5-B7D2-00AA00A204F1}', feature 'feat.SystemPerm' failed during request for component '{C50ED491-8358-4351-89DA-33E1EF15BE2A}'

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.


Event Type: Warning
Event Source: MsiInstaller
Event Category: None
Event ID: 1004
Date: 8/7/2005
Time: 6:22:10 PM
User: NT AUTHORITY\SYSTEM
Computer: YOUR-W92P4BHLZG
Description:
Detection of product '{CF5193F7-6B37-11D5-B7D2-00AA00A204F1}', feature 'feat.SystemPerm', component '{EB944547-9BA3-11D3-82BD-00C04FA309DE}' failed. The resource 'c:\WINDOWS\System32\msrepl35.dll' does not exist.

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.

The search within the reg edit produced NO hits for CF5193F7-6B37-11D5-B7D2-00AA00A204F1........

[tampabelle]

Hi Scout1,

Been researching your issue.


There are two things I want you to do -

1. Run Ewido. Click on Analysis ---> Startup ---> Save Report.

Post back the saved report in your next reply.


2. Download and run Windows Installer CleanUp utility from here - http://support.micro...kb;en-us;290301.

this utility will not let you save the list of programs. So please make a note of all programs and then post them here.

[scout1]

Catch 22 can be an evail thing. Below is the Ewido. Downloaded the Windows installer repair. Launched the install. Got my pop-up that said "Window preparing to isntall (It wasn't for this) and then got old faithful. Error 1500., installation in process, must complete this one first. So, could NOT run the MS installer repair program. Other than it's just an "uninformed observation" but it does appear to know when an MS product is in the area. Locks down pretty [bleep] tight.

I realize I'm a babe in the woods, but a stupid question. If safe mode will re-boot and normal will not, why not just nuke the "offending" processes, assuming they can be a identified ? Kill them from starting in the first place. ?????



Here's the Ewido stuff. Sorry for the text wrap.

---------------------------------------------------------
ewido security suite - Startup report
---------------------------------------------------------

+ Created on: 8:29:06 PM, 8/9/2005
+ Report-Checksum: 31B64418

Reg\HKLM\Run Motive SmartBridge C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
Reg\HKLM\Run NvCplDaemon RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
Reg\HKLM\Run YBrowser C:\Program Files\Yahoo!\browser\ybrwicon.exe
Reg\HKLM\Run Zone Labs Client C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
Reg\HKLM\Run TempRemove "C:\Program Files\Crystal Ball\CB Predictor\terminator.exe"
Reg\HKLM\Run USB C:\WINDOWS\system32\usb.exe
Reg\HKLM\Run Recguard C:\WINDOWS\SMINST\RECGUARD.EXE
Reg\HKLM\Run ShStatEXE "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
Reg\HKLM\Run S3TRAY2 S3tray2.exe
Reg\HKLM\Run PS2 C:\WINDOWS\system32\ps2.exe
Reg\HKLM\Run McAfeeUpdaterUI "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
Reg\HKLM\Run NvMediaCenter RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
Reg\HKLM\Run nwiz nwiz.exe /install
Reg\HKLM\Run KBD C:\HP\KBD\KBD.EXE
Reg\HKLM\Run HotKeysCmds C:\WINDOWS\System32\hkcmd.exe
Reg\HKLM\Run hpsysdrv c:\windows\system\hpsysdrv.exe
Reg\HKLM\Run IgfxTray C:\WINDOWS\System32\igfxtray.exe
Reg\HKLM\Run gcasServ "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
Reg\HKCU\Run Weather C:\Program Files\AWS\WeatherBug\Weather.exe 1
Shell\CommonStartup Adobe Reader Speed Launch.lnk C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
Shell\CommonStartup Microsoft Find Fast.lnk C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Find Fast.lnk

[tampabelle]

Hi Scout1,

Lol, nuke the process which is creating the issue ?? Well thats what I am trying. Cant seem to put my finger on what is getting installed and how to stop it.

Lets try this -

Open the task manager window ( Do a Crtl + Alt + del and then click on Task Manager. Click on Processes tab. Locate the item Msiexec.exe (MsInstaller) and kill / end the process.

Now try installing the Windows Installer CleanUp Utility. Post the list of all programs and then post them here.

If it doesnt work, then try doing the entire process in Safe Mode.

[tampabelle]

Hi Scout1,


One of my colleagues has this to say -


The trouble with developing windows installers is that sometimes they crash leaving the install partially finished. Any attempt to run an install after that results in the dreaded "Another installation is already in progress" message. Now you probably want to run an installer at some point again in the future, but until you clean up the install that crashed, you can't (I believe that it an install mutex is locked, among other things) .

So the Windows Installer Clean Up Utility is you friend. Trouble is the Windows Installer Clean Up utility comes as a windows install. So when you try to install it you are just going to get "Another installation is already in progress".

Digging a little deeper you may learn that the cleanup utility is just an app called msicuu.exe which is a front end to msizap.exe. You can extract both from the Windows Installer Cab file (msicuu2.exe) with a tool like WinRAR, or it is available with the support tools for the Windows OS you are using (usually on the install CD under support\tools or dowloadable from the web). That gets around the need to run the install.

[It also forms part of the Platform SDK Components for Windows Installer Developers (with a lot of other useful tools for installer work like Orca.exe which allows you to view msi files)].

msizap.exe is not for the feint-hearted. That is why Microsoft usually decently cloth it in msicuu (the Windows Installer Clean Up Utility see above). As always when playing with anything naked, be cautious. So prefer msicuu if you can. When you run msicuu it will present you with a list of failed installs, you can clean up your install if it is there. Otherwise you need to use the product code GUID with msizap



I would suggest that extract msicuu and then run it. It will list a whole host of programs. Please lit them here and then we can decide which ones to get our hands on !!!!!

In case you are not able to extract it, let me know. I may have a solution for that also.

[scout1]

Killing the process allowed a successful (and intriquing install) for the clean up utility. Below is a listing from the program, though unfortunately I could not cut-n-paste, so the listing below is manually typed in (don't think I made any errors).

The install started and got an error code (that I initially thought was old faithful, Error Code 1500). Was Error code 1760 or 1764 (?). Said it need to back out changes made for an previous install (MS Money) to proceed, OK ? Never saw a progress bar actually go backwards before. Afterwards, install proceeded uneventfully.

Most/all the MS items (app's anyways) came with the PC in 2002. Never used them. Limewire and Sonic Foundry is from my 20 year old. I have no problem waxing those if needed, or if not needed ;>

(All Users) Adobe Acrobat 7.0.1 and Reader 7.0.1 Update [7.0.2]
(All Users) Adobe Reader 7.0 [7.0.0]
(All Users) Command & Conquer Generals [0.50.0000]
(All Users) Command & Conquer TM Generals zERO hOUR [1.00.0000]
(All Users) HP RecordNow [3.10]
(All Users) Limewire [2.79.0008]
(All Users) Majestic Chess Demo [1.03.0000]
(All Users) McAfee ViruScan Enterrise [7.1.0]
(All Users) Microsoft .NET Framework 1.1 [1.1.4322]
(All Users) Microsoft AntiSpy [1.0]
(All Users) Microsoft Money 2002 [10.0.50]
(All Users) Microsoft Money 2002 System Pack [10.0.80]
(All Users) MicroSoft Works 6.0 [06.00.0000]
(All Users) MSN Messenger 6.2 [6.2.0137]
(All Users) MSXML 4.0 SP2 Parser and SDK [4.20.9818.0]
(All Users) Sonic Foundry Super Duper Music Looper XPress [1.0.69]
(All Users) TuneUp Utilities 2004 [4.1.2318]
(All Users) WebFldrs XP [9.50.5318]
(All Users) Works Suite OS Pack [1.0.0.0000]
DirectX for Manged Code Update (December 2004) [9.03.91]
Microsoft XML Parser and SDK [4.10.9406.0]
Windows Installer Clean Up [2.05.00.0000]
WitP_Utility [1.0.0]

BTW, I wanted to extend a very special thank you for all the effort to date. With your guidance, we have made progress with a very stubborn issue and it's starting to look much better (I think) .....

Please advise on the next step.

[scout1]

Never a dull moment....

Another interesting update. Wnet to check my email from my DSL service. This has always (of late) gotten me the "Windows is perparing to install" pop up for a moment, then goes away, only to repeat once more. It did it again though this time with a twist. Right after the "preparing to install", it changed to a Preparing to install Microsoft Money2002 System Pack, Gathering necessary info". This is repalced by another pop up that informs me that "The feature that you are trying to use is on a CD or other removable disk that is not available. Insert the Microsoft Money 2002 System Pack disk and click OK.", Default is " Source, Use Microsoft Money 2002 System Pack disk 1."

Checked my active processes and the msiexec.exe is back.

Didn't shutdown or anything after last past. Went straight to my web service.
Don't know if this provides any more insight or just another strange twist ....

[tampabelle]

Hi Scout1,


Since you dont use Microsoft Money at all, I suggest that you uninstall them using the cleanup utility. There are two components listed -

(All Users) Microsoft Money 2002 [10.0.50]
(All Users) Microsoft Money 2002 System Pack [10.0.80]

Uninstall them both.

Reboot the PC and let me know how your PC is behaving now

[scout1]

Used the install cleanup utility on both MS Money products. Windows did not shutdown directly afterwards, BUT has successfully shutdown as designed for the last 6 attempts. For the first 2 or so bootups, had windows updates (which apparently haven't been happening for some time) which proceeded without issue.

So I would say that your efforts have been very fruitful and I appreciate you "correcting the horizon" for me. The PC appears to be noraml again.
Though, this was a "series of events" to produce, hopefully the malware types don't employ this technique as I fear it would be very effective and provide it's own self-defense. The lack of a clean shutdown and re-boot disabled many "get well" things.

Again, my thanks for your efforts.

Scout1

[tampabelle]

Hi Scout1,

The lack of a clean shutdown and re-boot disabled many "get well" things.

Three things -

1) please post a fresh HJT log. Havent seen that in a long time

2) Let me know what you have disabled or what got disabled.

3) Let me also know how your PC is behaving and whether you have any issues with it !!!!

[scout1]

HJT Log file

Logfile of HijackThis v1.99.1
Scan saved at 7:37:35 PM, on 8/15/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Yahoo!\browser\ybrwicon.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\HP\KBD\KBD.EXE
C:\windows\system\hpsysdrv.exe
C:\Program Files\AWS\WeatherBug\Weather.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\system32\ZoneLabs\isafe.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\mcshield.exe
C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\BugHunt\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dsl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_6_0_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_6_0_0.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [YBrowser] C:\Program Files\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [USB] C:\WINDOWS\system32\usb.exe
O4 - HKLM\..\Run: [TempRemove] "C:\Program Files\Crystal Ball\CB Predictor\terminator.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O9 - Extra button: MktBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra 'Tools' menuitem: MarketBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (HKCU)
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe


Relative to my comment about things being disabled, nothing was disabled other than the ability to complete a valid shutdown. This is what I was referring to. Without a vlid shutdown, very little is actually performed. System restore - no good, windoes patches, - no good, etc .....

Relative to pc behavior, seesm to be back to normal. Still a little slower than I'd like, but no major issues.

Please advise.

[tampabelle]

Lets try two things -


1) You have three protection programs on your PC -

a. McAfee
b. Computer Associate's Isafe
c. Ewido

Running multiple such programs does not provide any additional security on your PC. It could however lead to conflict between the various programs and therefore hamper the performance of your PC.

I would suggest that you uninstall Ewido (which is anyway a trial product that you downloaded) and Isafe.


2) Click on Start ----> Run. Type in -

sfc /scannow

and hit enter. This wills earch for system files and verify whether they are current or not.


Let me know how both steps go.