Broken Blade

Greetings all. I started my PC yesterday and found many things amiss. The first indication of something wrong was that I had no startup sound. Sound will not play at all, be it Windows sounds, sound clips or movies. No errors are shown in the device manager for this.

The next indication was that my Windows taskbar started with different toolbars. Any windows I have open do not show up on the task bar, and when minimized they still do not drop to the taskbar, but become shrinked windows with the title bar and min/max/close buttons. I tried to open PC-cillin's console and recieved an error that stated:
"No network device was found, or there is a conflict with existing antivirus or security software. Only the Virus scan, Spyware scan, and Security Check functions will be available. To enable full product functionality, uninstall conflicting software or connect to a network, and then restart the program..."
I have not installed any new security software and am currently connected fine to my home network and the internet.
After that there is an error stating that it "cannot read the configuration" and gives error=7413-238, hr=0x800706ba
I do show that all functions of PCcillin are running, however I cannot open the console for it.

Internet Explorer 7 was recently installed, and crashes straight to desktop, as does the newest version of Windows Media Player. To run online virus scans I needed to install IE6, however the scans still do not work. I have a feeling this has to do with active X. I had no luck running the scans with Firefox.

I cannot copy and paste with shortcuts or mouse menues. I also cannot drag and drop files.

The search function from the Start Menu does not start at all.

Trying to run System Restore gives an error: "System Restore is not able to protect your computer. Please restart your computer, and then run System Restore again.

All of the processes I'm having problems with are supposed to start automatically, though they show stopped in the services tab of msconfig. I try to start any of them from services.msc and get errors like "error 193: 0xc1" for RPC and "error 1068: The dependency service or group failed to start" for PC cillin Console AND the System Restore Service.

Ad Aware and Spybot both found several items that the removed. The CW Shredder came up clean, as did Ad Aware and Spybot after subsequent scans. I do believe the PC cillin anti-virus is still active and protecting, as it is showing in running processes and was started in services.msc.

Safe Mode duplicates all of these issues.

My first thought was malware, but this seems to be a more deep-seated Windows issue that I don't have near the ability or capacity to further troubleshoot without a mallet or reinstallation, any ideas?

Girderman

Been noticing lots of IE7 complaints over the last few days. None have formed a pattern to my perception, but the "event" of it's installation on your computer may be causal more than coincidental.

I would uninstall it & see what happens, and use Firefox as interim browser while troubleshooting the system and/or repairing the system (if necessary) with IE7 removed.

Broken Blade

Thanks for the reply. When I went to run the online virus scans I kept getting "IE5 or higher" errors from firefox. I did uninstall IE7 so I could reinstall IE6 and try to run the scans. They at least progressed a bit further, but non of the several scans I tried actually worked. They'd all lock during the beginning stages.

Is there any way I can manually alter the damage IE7 has done or can I do a repair install of Windows?

Broken Blade

As a side note, to prepare for any possible bombs I need to drop I tried to backup my data. Of course I can't drag and drop to my second HD, so I tried to burn some backup DVDs. Of course that doesn't work either. If anyone could provide a possible solution to the backup issue or a way to fix without needing to backup, it'd be greatly appreciated.

Girderman

You should be able to drag & drop in Safe Mode. If not, I would think you have a serious problem. Backing up your data is prudent.

This was the scenario my "total removal" suggestion was intended to avoid. I suggest getting rid of it all, troubleshooting whatever problems are still there and/or verifying there are none before trying a reinstall of IE6.

At this point you don't know if you have one or multiple causes to your problems. Effecting a complete removal of IE6/7 rules out that as a cause, and allows you to consider other sources of problems.

I wouldn't rule-out malware at this point, in fact I think it is likely. Scanners & programs are useful, but they are not absolute. Frequently it is the reliance on them that is the ultimate cause of chronic/difficult to solve problems.

Posting a log in the HJT forum is (I think) a good idea, but I would completely remove IE first and then start making an assessment of what (if anything) is still wrong with your computer.

Running sfc /scannow might also be a good idea, again after IE6/7 is removed, as would running chkdsk.

Broken Blade

Interestingly enough, I've unistalled IE7, yet it's back in my add/remove programs list. I did it a few more times and it still shows up. The browser I'm currently using is IE6 and cannot find an IE7 .exe. Help/About Internet Explorer populates no version, cipher strength or product ID info. I had already tried sfc /scannow several times but it closes straight to desktop. Guess I'm on my way to post HJT. Now to find a way to link this thread over there with no copy/paste function :(

**edit** Posted under same title in HJT forums

Girderman

Alright, lemme "theorize" as to WHY I suggest to have BOTH completely removed.

I occurs to me that perhaps IE6 & IE7 may share some common (unchanged) files, and that what may be happening at present is that pieces of one version that is supposed to be uninstalled are attempted to be used by other pieces that are installed. You will not have control over what is going on until you can achieve a status where you can confidentaly believe that neither of them are cause "the problem".

If the problem persists despite both being removed, you can assume that the problem does not have anything to do with IE of either version, and then troubleshoot accordingly.

Or, conversely, trying to isolate the problem (or problems) with the added confusion of cross-mismatched and/or corrupted files doing strange things will interfere with looking for problems that do not have to do with IE, ie. malware.

Posting a log in HJT is a good idea...

Broken Blade

I understand, and I did try to remove them both after you suggested that. IE7 keeps repopulating in the list of add/remove and IE6 is not there at all. The instructions to remove IE6 in the MS knowledge base article didn't help me at all since they add/remove programs list is not reflecting what is currently installed.
Trust me, I'd like nothing more than to have them both completely removed so that my troubleshooting can continue, but they're not making it easy.
I know it kinda seems like I brushed off your advice, but I really did try, I swear! I didn't come here to pick and choose what I will follow, I came here because I couldn't solve my problem and thought I'd defer to some helpful experts :)
There is currently a thread in the HJT forum with the same title as this where Reid has been guiding me through several good steps towards a healthier, happier PC.

Girderman

Wonder if there are instructions for manual removal of Internet Explorer.

Here, try this:

Download & install RegSeeker and click "Installed applications>Add/Remove Applications"

Before running RegSeeker, turn off System Restore by (right-mouse click) "My Computer>Properties>System Restore and click the button "Turn off System Restore on all drives".

Use the "Ctrl" button and the left-mouse button to select the Internet Explorer Entry(ies) to remove and then right-mouse button click "Delete selected Items".

Shut down & restart machine and verify they are gone (or not) in add/remove.

If this fails, we should start looking for manual removal of IE instructions.

Broken Blade

It seems enabling/disabling System Restore also generates an error and will not toggle from its current state (on). Should I still attempt to run RegSeeker with System Restore on?

Girderman

No I suggest you do both System Restore disable & regseeker from Safe Mode. If that fails I would say it's 90% likely mlaware.

Broken Blade

From Safe Mode I was not able to remove IE7 from add/remove (rather, I removed it and rebooted and it was still there. I was also still unable to turn off system restore from Safe Mode. I tried it on all drives, then on a couple individually and got the same "System Restore encountered an error trying to enable/disable one or more drives. Please restart your machine and try again."
RegSeeker does have several entries that say IE5 and IE6, but no IE7. Would removing them without disabling system restore accomplish anything?
Again, thanks for all your help.

Girderman

Okay Reg Removal is one of the riskiest endeavors, because a corrupted Registry can prevent the machine from booting. So anything you do with the Registry must be done with the understanding that it is at your own risk.

Given that, I cannot even suggest what I think you should do, I can only tell you what *I* would do in your situation. You will have to decide if you think you can do it successfully, and/or if it is worth the risk.

Having said that, Interent Explorer is a program that can be re-installed right from the XP disk, so any "damage" done to it can be "repaired" simply by reinstalling it. And we (by removing it) are "damaging" it to the maximum. This is the "nuclear" option. We INTEND to delete ALL of it.

The risk is if you delete something that is NOT Internet Explorer.

The other thing to keep in mind is that Registry Entries are all cross-related. One reason it is called a "hive". There are "key" registry entries, and then there are secondary/supporting entries. All are cross-linked, so if one "key" entry is deleted, the rest of those that are related to it are "hanging" without connection.

It is these "hangers" that programs like RegSeeker are designed to find and delete.

This all means that you really only need to delete the "key" entries, and then run RegSeeker to find the rest and delete them automatically. This is safer because you do not have the risk of accidentally deleting the wrong key (meaning one that is not part of IE).

First, I don't think anything to do with IE5 is relevant to this, in fact I have been reading tonight (while working on & thinking about your problem) that there are installations of IE4 that are saved by XP on the hard drive on purpose. (For what purpose I cannot imagine.)

So I would limit all consideration to only IE6 and IE7, and ignore any version older than those two. So since you say you have no trace of IE7, that leaves only IE6 to consider.

The hard part for me here is to communicate how I would decide which IE6 entires are "key" and which are secondary. You will either have to do that for yourself, or you could post a screen shot of the list of keys RegSeeker shows you and I could maybe suggest one or more for initial deletion, with a run of "Clean Registry" to get the remainder.

Have you run the "clean registry" function on regSeeker yet ? If not, you might (possibly) fix your problem by doing that, although I have never experienced or heard of a problem being fixed by a reg cleaning program, I think it's theoretically possible, if something is there that shouldn't be, and it is causing problems.

Finally, even if the worst should happen, it should all be repairable by a repair install from the XP disk, of course providing that you have one. This is a "looming" option anyways, because if the reg deleting doesn't fix it, and malware isn't causing it, a Repair Install is just about the last option before a New Install.

Broken Blade

I am currently backing up all of my data, I had to load a Knoppix disk in order to drag and drop files to my external. All of Windows' parallel functions in Knoppix do work fine. During the transfer of a 100+ GB I've been searching for a good rundown of IE registry keys but haven't been able to find anything. I did find an IE7 uninstall toolkit on MS's site, but that was unable to remove the program as well (even after adding the InstalledByUser entry).
I did run the "clean registry" function of RegSeeker, and it found a ton of orphaned entries. Since I will have all my data backed up I wonder if it wouldn't be best just to do the repair now.

Girderman

I think Repair Install is more likely to fix what can be fixed, and it sounds like you are fairly well-informed to make the decision one way or the other.

I don't like doing Repair Installs because of the time involved in doing them, and the monkeying around with everything (like settings) getting things back to the way they are "supposed" to be. But it's a judgement call I think in terms of your time.

Before doing any of the General Repairs, I would make sure that the HD is free of errors, and scrub the HD form malware. If you have a Knoppix disk and know how to use it, do you have a good AV program that you can run in Linux off the Knoppix CD ?

Also, unplugging any unnecessary hardware before doing the repair (be it sfc in Safe Mode or a Repair Install) is a good idea on the chance that it is a hardware/drive problem causing everything. Getting an unnecessary and possibly bad device separated from the system during repair events is also a good idea.

I wish I were there to experience this "hands on" as the symptoms seem "off-balance" to me getting my information second-hand like this. Hope things go well for you. I will continue to monitor the thread on the chance that I can be of some use.