ME Help Please

[momiam2six]

2. What antivirus do you use, and do you manually update it regularly? If it's old, as in 2001, try an online scan.

I usually use Norton Virus protection. Did a full scan yesterday with nothinig showing up. Definitions updated yesterday as well. There is an online thing that will do a virus scan I will check out in a few...think it is houscall or something similar to that.

[Quote]3. Check your restore CD for a folder named WinME or a folder with lots of .cab files. Let me know if it's there and if there is also a setup.exe file in the folder.[/Qoute]

Not that I can find, but then I might not be looking right. Will check further.

4. Scan for spyware using adaware, or spybot (best to use both) and remove all that adaware finds, and all that spybot finds marked in red.

Put both in last night and used both and removed all 90 something things

Some options
I know 750 mp3's take up lots of space when burned as a music CD, but if burned as a data CD, they won't take up near as much. About 100 MP3's per CD

Hmmmm How can I tell if it is a music cd or a data one? the ones I have hold 700MB are CD-R 48X Multi speed

Give me an idea of your PC experience level so I can limit the level of details in my responses. Dos, windows, and hardware hands on knowledge. [/B]

Hmmm my experience level is lol Anything I know I have taught myself. I have opened up the puter and put in more memory.
I do not usually mess with it in any technical way because I am sooo afraid of messing it up. I think I have used DOS (that would be the MS Dos thing right?) maybe once.
I know very little, but do catch on quickly.
Your help is so very very very appreciated!
God Bless
Louise

[Norm]

Good morning

Ok here's a quick rundown, don't mind the shortness of my post, just try to save time and typing (I'm a two finger typer

1. Should be running a bit better now with 90 spy's gone.
2. Probably rule out a virus.

3. Uninstall Real Player, then delete the folder it uses C:\Program Files\Real (or Real Player) It causes errors and freeze ups.

4. Uncheck (in the VXD tab in msconfig) the one related to symantec

5.There's quite a few starting up you don't need, and a couple look suspicious to me (but they may be legit programs, can't tell) I'll get back to you with recommended removals.

6. Disable System Restore

7. The CD disk itself doesn't matter, there is an option in the burning software to make data CD instead of music CD. When you choose music CD it converts the MP3 to Wav files, and they are about 10 times as big. Choose data CD instead when burning. (Just for backup purposes)

8. Reboot after all these suggested changes

I'll be back with some screen shots to help you with those startup apps. Will take a while, be patient

[Norm]

Uncheck the ones marked in red, and leave unchecked all that already are unchecked. The reboot.


Use your PC for a while and try to make it work hard, multitask it play a game or two, and see if it's starting to act better.

[MadDoctor]

Hi Norm. I'll bet his registry is a mess. Maybe RegScrub?

[Norm]

Originally posted by MadDoctor
Hi Norm. I'll bet his registry is a mess. Maybe RegScrub?

That's coming Doc, I like System Mechanic. Thanks for pitching in.

Ever had trouble with regscrub Doc? Can you delete everything it finds without trouble? I've never used that one.

[JawZ]

Originally posted by MadDoctor
Hi Norm. I'll bet his registry is a mess. Maybe RegScrub?

Why not just use Regclean from Microsoft? It's free and easy to use. Saves the undo file in the same folder as well.

I ran ME for a long time with hardly a hiccup. mwkirchner did as well. It needs a little TLC but it's really no different from any 9.x core system.

To backup your mail in OE is really easy...and you don't need any program to save it. It's a simple copy and paste job. All the .dbx files are your mail folders. Do a search for them and locate the root folder for them. It's something like Windows/Application/Identitites/wetwte36tgewrtw/Outlook Express.....then you'll see those .dbx files. You can copy and paste them to wherever you like and you can even burn them to CD-R. All for free. Make sure you also backup your address book. You can easily back that up from within OE or you can do the same thing and just copy it or burn it to CD-R along with all your .dbx files. Just do a seach for wab (windows address book) and you'll find it. Copy and burn baby!!!!!

I'll stop for now.

[Norm]

UOD thanks for pitching in as well. I'm sure I'll forget something as we go through all this repair.

System Mechanic saves an undo file as well,(it has a backup tab where you can backup before you start) plus it removes orphaned dll's. The MS regclean ONLY fixes MS entries, but won't touch 3rd party stuff. (as far as I've ever heard anyway)

[JawZ]

Originally posted by Norm
UOD thanks for pitching in as well. I'm sure I'll forget something as we go through all this repair.

System Mechanic saves an undo file as well,(it has a backup tab where you can backup before you start) plus it removes orphaned dll's. The MS regclean ONLY fixes MS entries, but won't touch 3rd party stuff. (as far as I've ever heard anyway)

I used system mechanic everyday while I ran ME. Only one hitch...it aint free. cough.

Let me know if I can help.

JV16 power tools is free though and does everything that System mechanic can do save for the tweaks.

http://download.com.com/3000-2094-10...ml?tag=lst-0-1

[Norm]

Sys Mech is good for 30 days, that's all the time we need, I hope
If UOD thinks JV16 power tools is ok, I trust his judgement.

UOD one thing you can help me with....How to get to Real Dos mode in ME. Without any 3rd party trickery. I am rarely on ME machines, and it's not an option in the boot menu, so I normally use a 98 floppy.

[JawZ]

Norm,

http://www.geocities.com/mfd4life_2000/

Beware....it has been noted that instability could arise from doing this. I did it and noticed nothing but that is just one computer.

I suggest the floppy method as well.....why mess with an already unstable system?

BTW....uuse System Mechanic first...as you said it's good for 30 days and it's pretty easy to use. JV16 might be confusing to a novice but in time, she'll learn how easy it really is....and again, it's free.

[MadDoctor]

Originally posted by Norm
That's coming Doc, I like System Mechanic. Thanks for pitching in.

Ever had trouble with regscrub Doc? Can you delete everything it finds without trouble? I've never used that one.

I use several tools. Never had a problems with regscrub and yes I've deleted everything it says is a problem (on 6 of my computers). UOD... I also use regclean.

[Norm]

Thanks again.

I don't want to try any messing with the root files. Not over the net. I've done some playing with getting Dos into ME too, and it can cripple the boot process if not done carefully.

Here's what I'm still planning on doing

1. Check device manager for flagged devices.
2. Delete all IE temp,history, and cookies. From Dos
3. delete all temp files From Dos
4. clean registry and fix registry using Sys Mech, or jv tools, and then scanreg /fix
5. If possible reinstall ME over itself.
6. Check startup for any files that got rewritten into startup remove them some other way (uninstall the apps)
7. uninstall any apps not worthy of being on the machine
8. Backup the registry

Anything else you can add?

edit - Oh can't forget to install a virus app - probably AVG

[momiam2six]

2. Probably rule out a virus.

I scanned the computer with an online thing, housecall. It found 39 things all the same name, WORM KLEZ.H all entries say it can not access the file, and all are in the C:\_restore folder. I think this is where I got attachments that Norton scanned before they actually hit my email, and quarantined them.
Will not let me clean them, or delete them says they are currently in use.

[JawZ]

I'd make a restore point on the machine then drop it's saved storage to 200MB. I'd also delete all the restore points except for the current one.

But if you choose to shut it down...the drop it down to 0%, delete all the restore points except for the current one and then turn it off. If you turn it off without trimming it's size down...then you just wasted X amount of space.

I'd also export mail, address book, cookies and favorites to removable media just in case.

[momiam2six]

6. Disable System Restore

How do I do This

[Norm]

Not too worry, we're going to delete that entire directory from Dos eventually. If they are in there only you're safe.

The virus isn't in use, the _restore folder is. ME constantly writes to that folder and backs up your system state.

Have you done everything mentioned as yet?

Hows your system running now?

I should pay more attention to usernames, I just noticed you are a mom of six. My mother was a mom of seven.
You sure you have time for this?
Just kidding with you, but boy you must be a busy woman.

[JawZ]

Originally posted by momiam2six
I scanned the computer with an online thing, housecall. It found 39 things all the same name, WORM KLEZ.H all entries say it can not access the file, and all are in the C:\_restore folder. I think this is where I got attachments that Norton scanned before they actually hit my email, and quarantined them.
Will not let me clean them, or delete them says they are currently in use.

Oh no......

I was afraid of that. To get rid of this is gonna be tough but it is very doable.

You have to fully disable system restore in order to clean the virus because it is hiding in that system protected folder.

Let me dig up the fix for you. BRB.......

http://securityresponse.symantec.com...oval.tool.html

[Norm]

Better to delete that folder in Dos, then run Nortons fixklex.com from safe mode, then renable system restore UOD.

[JawZ]

Originally posted by Norm
Better to delete that folder in Dos, then run Nortons fixklex.com from safe mode, then renable system restore UOD.

Make sure you get rid of the reg entries.

[Norm]

Originally posted by UOD
Make sure you get rid of the reg entries.

I doubt the virus is active. But fixklez.com will take care of it.

That _restore folder is probably huge and is part of the overall problem with the system restore. I was planning on deleting it and starting a fresh restore point later.