Machine66

A month ago my P4 machine died on me and I came here for help, I'm testing out a newer PSU tonight for it and crossing my fingers. But since then I've resorted to using my old P3 Windows ME machine that was born in the 90's. Well now this old machine can't load Windows, but I think I know the cause.

The past few days I had been randomly losing hard drive space, missing 1 GB, gaining some of it back, missing another 400 MB etc. I ran my spyware programs (none of them would work except ScanSpyware) to see if maybe a virus was sucking up space. It deleted some registry values and some files (I'll paste the logs below) and I strongly feel that a necessary file/HKEY was removed. Now when I start my computer it'll come up with a blue screen of death after the BIOS as it tries to load Windows ME. The screen says "Windows protection error. You must restart your computer. System haulted." The computer boots fine in safe mode currently.

Unfortunately, much to my surprise, my System Restore either wasn't on or is messed up, because I don't recall disabling it. The ScanSpyware program didn't have a restore point of it's deleted files either, as you have to do it manually, which I wish I knew beforehand. I know some anti-virus programs will backup what you delete just in case.

Here's a condensed version of the scanspyware log file that shows what was deleted. I left out the cookies and the last HKEY listed had 82 indentical copies of itself removed, I left just 1 listing of it:

Pest: MainPean Type: Registry Key Operation: Deleted Value: HKEY_CURRENT_USER\SOFTWARE\FreeWare _____________________________________________ Pest: scagent.B Type: Registry Key Operation: Deleted Value: HKEY_CLASSES_ROOT\typelib\{C89E0F84-3C34-43D1-A72C-AF1A160A7C07} _____________________________________________ Pest: scagent.B Type: Registry Key Operation: Deleted Value: HKEY_LOCAL_MACHINE\Software\Classes\typelib\{C89E0F84-3C34-43D1-A72C-AF1A160A7C07} _____________________________________________ Pest: SearchForFree Type: Registry Key Operation: Deleted Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\icasServ _____________________________________________ Pest: ABETTERINTERNET.Respondmiter Type: File Operation: Deleted Value: C:\WINDOWS\satmat.ini _____________________________________________ Pest: ABETTERINTERNET.Respondmiter Type: File Operation: Deleted Value: C:\WINDOWS\inf\satmat.inf _____________________________________________ Pest: Agobot.BY Type: File Operation: Deleted Value: C:\WINDOWS\SYSTEM\nvsvc.exe _____________________________________________ Pest: Habrack Type: File Operation: Deleted Value: C:\WINDOWS\WinSys.Dll _____________________________________________ Pest: Harnig Type: File Operation: Deleted Value: C:\WINDOWS\test _____________________________________________ Pest: Trojan.VxGame Type: File Operation: Deleted Value: C:\WINDOWS\SYSTEM\thn.dll _____________________________________________ Pest: MainPean Type: Registry Key Operation: Deleted Value: HKEY_CURRENT_USER\SOFTWARE\FreeWare _____________________________________________ Pest: scagent.B Type: Registry Key Operation: Deleted Value: HKEY_CLASSES_ROOT\typelib\{C89E0F84-3C34-43D1-A72C-AF1A160A7C07} _____________________________________________ Pest: scagent.B Type: Registry Key Operation: Deleted Value: HKEY_LOCAL_MACHINE\Software\Classes\typelib\{C89E0F84-3C34-43D1-A72C-AF1A160A7C07} _____________________________________________ Pest: SearchForFree Type: Registry Key Operation: Deleted Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\icasServ _____________________________________________


(icasServ is the one that had 82 copies)

Hopefully you are familiar with the deleted files and can spot it right away. I'm hoping I can restore the file(s) or registry key(s) in safe mode and thus fix the boot problem. Also to note: I looked up several of the files and got results suggesting viruses, but I read that "C:\WINDOWS\SYSTEM\nvsvc.exe" belongs to my NVIDIA video card and that it also has a virus version of the same name. I'll check and see if I still have a file by that name on my computer. If it WAS Nvidia's file and it's deleted, could that be the cause for blue screen of death at boot up and why only safe mode works?

Thanks very much for your help guys, just let me know if you need any more info.

Mike F.

Machine66

UPDATE: I re-installed the latest Nvidia drivers that I already had on my desktop but that didn't fix the problem. I've read several different ways to approach the Windows protection error problem and one of the most common ones suggests scanreg /restore. I typed this from Start->Run and the 2 dates listed are from 2005. I've been using this computer for the past month, but before then it wasn't used in about 2 years maybe more.

My question (for the moment) is "is it dangerous to restore a registry that isn't quite recent? Can I expect to lose files?" If my math is correct the 2005 settings are from about 7 months prior to when I stopped using the machine. Are System Restore and scareg /restore 2 completely different things? Because my System Restore didn't offer a single restore point, but scanreg displays 2 from 2005.

I've read Windows ME doesn't have a "Command Prompt Only" option in BIOS and thus requires using a boot disk to access it, but since I can access Safe Mode's Run window does that mean I won't need to use the Command Prompt Only option? I'm afraid to click the 2005 registry setting, not knowing what could happen, so I'll wait for a reply before I go through with it, just to be safe.

Machine66

UPDATE: Computer is BACK up and running Windows

I talked to a couple tech-savvy friends and they said it should be okay to load registry backups that are on the old side. I went ahead with it and it worked. See I solved it all by myself! lol, have a good weekend guys.

Jlp1928

Hi Mach,

Glad to hear that you got it going. For future referece, ME should work the same as 98 and XP. Go to RUN and type COMMAND. Should give you DOS under Windows. If Win is not running you are correct about the boot disk.

Luck, Jim

Masterworm

When in trouble hit the f8 key..?on reboot.