scanreg /restore FAILED

Hi Bill

thanks for your reply.

In C:\Recycled the follwing files only are there:

desktop.ini     65    04-22-03   11:18 a
dc0.tmp    <Dir>      03-19-03   11:12 a
inf02           300   04-23-03   10:45 a

I opened the info02 with edit and I saw the file which I remember to have deleted.I also see lot many junk characters as you would when you edit an exe file.Here are the contents of the info2 file under edit :

junkC:\MCA33D4.TMP  CA33D4.TMP  junkYG C:\RECYCLED\DC0.TMP m e r i c a    \Quic junkjunkjunkjunkjunk junkjunk

Is this any good?

Is this what you are talking about?

I am sorry but I did not understand your last step of

  " COPY DC?.xxx PATH\CORRECTNAME.xxx "

Where do I enter this command? at C:\?? or at C:\Recycled\??

Do you think this would work for sure??

Thanks in advance.

           probably tried this already but have
          you done   c:scanreg/fix  ????
          what did it tell you after you did it???

 

               this site is more confusing than
             microsoft but maybe there's a possibility
             that you know how too make batches ??

       http://www.edicity.com/FAQ_02.htm

Hi compu

I have not yet tried to recover from the recycle bin and reboot.I am waiting for Bill to respond to my questions.

And I have not tried scanreg/fix.

Do you think I can still try scnreg/fix after already having done all the steps (and goof ups) I described?

Will it be safe to run scanreg/fix now that I do not have more than ONE good regbackup by the name of rb005.cab.

At this stage,will scanreg/fix work properly or make matters worse?? what will be the impact of running this now?what id this fails?will I be worse off than now?

Thanks

MS99, sorry, I posted the comment in haste before my ISP cut me off. You will get the full information from:

http://tweakhomepc.virtualave.net/safe/z_deleted.html

What you are doing is first removing the System and Hidden attributes from the "Recycled" folder so you will be able to access it.

You are then going into this folder and removing the "Read Only, System, and Hidden" attributes for all files so you can view them with the DIR command.

You are doing a DIR command to sort them into date order (earliest first).

Having found the most recent deletion, you are opening it in "Read Only" mode so that you won't corrupt the data.

The hope is that, by reading the contents, you should be able to ascertain what this original file was, and where it should be restored to, which is what the last line involves.

If this can't be ascertained, I will need to check and see what command Windows uses to restore the file to its original path and file name.

The "Info" file in the recycled bin under DOS is the index to the files deleted and stores the original path and file name.

Remember to open it as edit /r info2

I should have said, restore the attributes after you are done by adding a + in front of the same attrib commands used before with a - (minus sign). ie. reverse the process.

       Yes you can still run scanreg/fix if bill's
       idea doesn't help you.

       scanreg/fix  fixes your registry so your ugly
          messed up backups shouldn't interfere.


        But if your registry files are corrupted
        by a virus then  scanreg/fix  might not
        work.

        I can't say 100% percent sure cause I
        don't know the whole source of the problem
        but scanreg/fix should not mess your registry
        up but fix it  as it says .......

        If it does you can always restore the one
        good one you have if any.....

         Just do a backup of your good one before
         you start the process if it's a good one.

         Also might wanna check your scanreg.ini file
         see if anythings off.

         In there you can change the number of
         registry backups,  whether it optimizes at startup
         and whether it backs up at all.

         Theres also backup directories for your

        windir
        systemdir
        bootdir
        boothost
       
   

       

1. under scanreg/fix, would the system use the
   rb005.cab  which i believe is still good??
   
   by hook or crook i still want to hang on to this dear
   file( anyway, i made copies of all the cab files in
   another directory)

2. under scanreg/fix,if even the rb005 gets bad, i can
   copy back from the backup file into C:\windows\sysbckup

   am i right??

3. i have already posted above,the contents of the info2
   file under C:\Recycled
   
   anyway,here it is again

junkC:\MCA33D4.TMP  CA33D4.TMP  junkYG C:\RECYCLED\DC0.TMP m e r i c a    \Quic junkjunkjunkjunkjunk junkjunk


4. if the above information is what is needed,then how do
   restore MCA33D4 from info2 or some other place, to C:\
   where it earlier was before the problem?

1. under scanreg/fix, would the system use the
   rb005.cab  which i believe is still good??
   
   by hook or crook i still want to hang on to this dear
   file( anyway, i made copies of all the cab files in
   another directory)

2. under scanreg/fix,if even the rb005 gets bad, i can
   copy back from the backup file into C:\windows\sysbckup

   am i right??

3. i have already posted above,the contents of the info2
   file under C:\Recycled
   
   anyway,here it is again

junkC:\MCA33D4.TMP  CA33D4.TMP  junkYG C:\RECYCLED\DC0.TMP m e r i c a    \Quic junkjunkjunkjunkjunk junkjunk


4. if the above information is what is needed,then how do
   restore MCA33D4 from info2 or some other place, to C:\
   where it earlier was before the problem?

Sorry, I didn't look back again.  In too much of a hurry these days.

So, the index file "INFO2" in the "C:\Recycled" folder tells you that it has a folder <DIR> dc0.tmp. It also tells you that this folder contains a file "ca33d4.tmp".

I have just replicated what I think happened, by doing the following in Windows:

1. Created a folder "C:\mca334d4.tmp"
2. Creating a dummy file within it named "ca33d4.tmp"
3. Deleting the entire folder "mca334d4.tmp" to the recycle bin.

Viewing the "info2" file in full DOS gives me exactly the same results as yours, except that yours will probably show a file size whereas mine was a zero byte dummy file.

It SHOULD have been possible, after removing attributes, to either copy the entire folder "dc0.tmp" to the C:\ drive (using COPY or MOVE) and rename it C:\mca334d4.tmp in the process.

Unfortunately, each time I tried this, it kept trying to do so while indicating that it was copying the dc0.tmp folder AND ca33d4.tmp inside it, but I kept getting an "unable to open source" error.

I tried moving into the folder "mca334d4.tmp" and copying the file "ca33d4.tmp" to a folder which I had manually created in DOS as "C:\mca334d4", but got the same error.  The same happened when I created the folder as "mca334d4.tmp".

Much puzzlement :-(

Here's the only way I have tested this and got it to work in full DOS using the dummies I created and then deleted from Windows:

cd \
attrib -s -h recycled
cd recycled
attrib -r -s -h *.*
md C:\trial
move dc0.tmp\ca33d4.tmp  C:\trial\ca33d4.tmp
ren trial mca334d4.tmp
dir C:\mca334d4.tmp
rem it shows the file ca33d4.tmp has copied successfully
cd ..
attrib +h +r +s *.*
cd \
attrib +h +s recycled
win
rem starts windows

Please DON'T risk this if you have any reservations because, although I have tested it using dummy files, I can't be certain what attributes the original folder and file may have had before you deleted them. Nor can I be certain if the file will copy without altering the data within it.

I used MOVE rather than COPY because I am pretty sure that it copies files intact whether binary or ascii (although maybe I have misunderstood this originally while learning DOS a long while back).

If it doesn't work, maybe booting to full DOS and assigning +h or +r attributes against the recreated folder and file might work.

Of course, there is no guarantee that this IS the actual source of the current problem, but it seems coincidental that this happened after deleting the folder, and that the "mca" part of the folder matches what you recall about thinking it was associated with mcaffee.  It may well be that there is still a call for this file in one of your system files eg. autoexec.bat when your system is booting, and, without it, your boot won't go beyond this.

Just a thought.  If the folder and file WERE connected to mcaffee, and you can get back into Windows, I think maybe you should reinstall it, reboot, uninstall it, and reboot again.

My thoughts are that maybe after uninstalling, you didn't reboot to get rid of all files, lines in system files, and registry entries, thereby leaving some debris such as this folder you deleted.

Who knows, maybe it isn't connected with mcaffee after all, but I can't find any similar files on my system and a web search for the pattern of the file name reveals nothing.

Another thought here.  By doing a registry restore to an earlier point, your system probably still thinks it has mcaffee installed and is looking for files.

Wow Bill,

kudos to you! you are taking so much interest and pains.

but i am no expert like you and hence i am very reserved now as to what step i shud take next.

do you think going into autoexec bat wud help?perhaps some mcafee file being called as u say?

can we tweak the autoexec bat file??

Bill, can you please go thru all my postings right from the very first, put them together and try to infer anything?you must be very busy,i know, but it would be great if you could do that.

it might give you some more clues.

i guess this problem of mine is giving a lot of exercise to all you guys who are very interested in taming WIN98!

but i am sure many people would have already faced this kind of issue.

the first time my registry got bad,i ran scanreg /restore and it did the job.this time it has not.i am looking for a solution which is this simple and avoids reformatting the HD,reinstalling WIN, etc.

           did the scanreg/fix work ?????
            you can get too the file autoexec.bat
            from dos but that might not help
            you can check both files and edit them

            by typing at c:prompt

              C:edit autoexec.bat
           or C:edit config.sys

               delete anything symantec in there

             did you already run scandisk as well?

            Did any of this work ????

            Sounds like the mcafee did this too
           you sometimes programs leave behind files
          and folders because stuff like mcafee
          ties in too so many other system files
          that the uninstall cant dispose of them
          safely.
 
           Restore any mcafee files that might
           be in the recycling bin that or
           format.

           Problem started after you deleted mc
           most likely caused a system tunnel
           registry being one of them.

           If you can restore a registry that
          had the mcafee files in it might help
          might trick the o/s for a while.....
          but unless you can restore the mc folder
          you'll most likely be faced with a format
          because mc was probably tied in too the
          system files and you cant do a system
          restore like xp unless you backed up your
          system onto a disk........

         

        go here and read this page of mostly
        complaints you aren't the only one
        who had trouble with mcafee firewalls

http://www.cnet.com/software/0-352108-1218-6357663.html

        its risky downloading any shareware
        like symantec firewall if you get
        a firewall get a freeware version like
        Zone Alarm 3.7 or a store bought version
       
        best too go with a highly recommended
        product if you go with shareware check
        around in a search engine and see how
        many people had troubles, legitimate
        troubles with it like it slowed their system.

compu04,

the contents of the info2 file under C:\Recycled
 

junkC:\MCA33D4.TMP  CA33D4.TMP  junkYG C:\RECYCLED\DC0.TMP m e r i c a    \Quic junkjunkjunkjunkjunk junkjunk


(I am not sure if the second file is just CA33D4 or MCA33D4,but both sound 99.99 % similar to the first one)

I am 100% sure that these files are the culprits belonging to McAfee.

I just chatted with a McAfee tech support online and she said that MCA33D4 is a folder.

But now the question is, how do I get to restore this Folder from the recycle bin to its original location at C:\

please note, i cannot boot to windows at all.everything has to be done thru DOS only.

replies to your questions:

no, i did not run scanreg/fix

i am afraid that editing the autoexec bat and/or config sys might only complicate the matter further, so i have not done anything in these as yet.

Today,I booted for the first time (after the problem) WITHOUT the start up disk,pressed F8, used Safe Mode, i got the message that since i had not shut down windows properly, it will run Scan Disk.And it completed the scandisk 100%.but after that, there was an error saying that Explorer has performed an illegal operation and it needs to shut down.That was it!

I did not try anything else.

I am very much upset and dont want to take more risks as of now, i am still waiting to hear some concrete solution from someone before i tweak anything else and cause irreparable damage.

    here is a page of info that will help you
    tons in your quest for restoring files

         http://www.computerhope.com/movehlp.htm#04

 The home page for this is

         http://www.computerhope.com/msdos.htm

MS99

To restore the folder and the file which are sitting in your recycle bin, do exactly what I have detailed below:

1. While your machine is off, put your Windows 98 Boot floppy disk into the floppy drive and switch the machine on.  It will run through a load of lines and eventually stop at what's called the DOS prompt for your Floppy Drive.  It will show as:

A:\>

2. None of the Commands in DOS are case-sensitive ie. type them in capital letters, small letters, or whatever. You have to leave spaces in the right place, though.  Every command line which is shown below must be confirmed by hitting the "Enter Key". I will show this as <Enter>.  You can switch off your computer at any time while in DOS, it's not like Windows where you have to go through a sequence.

3. Change to your C:\ Drive by typing
C:  <enter>

4. Now type the following commands as I've detailed below. I've left double-spaces to make these more obvious:

cd  \
attrib  -s  -h  recycled
cd  recycled
attrib  -r  -s  -h  *.*
md  C:\trial
move  dc0.tmp\ca33d4.tmp   C:\trial\ca33d4.tmp
ren  trial  mca334d4.tmp
dir  C:\mca334d4.tmp
cd  ..
attrib  +h  +r  +s  *.*
cd  \
attrib  +h  +s  recycled

5. Power off your computer, remove the floppy disk, and see if it boots up to Windows.  If it doesn't, then it might be that the file or folder haven't restored properly.

NOTES: When you do "scanreg /restore" in DOS, it is restoring one of the registries from when your computer last successfully booted up.  In the restored registry, there is probably some entry which is calling on some file that was present when Mcaffee was on your system.  Now that it isn't there, it can't find the information to start.

Generally, AntiVirus software and similar applications are set to be started from a line in C:\Autoexec.bat.  For instance, Norton AntiVirus places the following line as the first entry before the computer even sets the code for the language it will use:

C:\PROGRA~1\NORTON~1\NAVDX.EXE /startup

The following lines (or similar, depending on the settings), should always remain there.

mode con codepage prepare=((850) C:\WINDOWS\COMMAND\ega.cpi)
mode con codepage select=850
keyb uk,,C:\WINDOWS\COMMAND\keyboard.sys

To test what will happen if you intend to remove a line from a batch file like autoexec.bat, you put "rem" (without the " ") in front of the line and leave a space before the first letter on that line.  This "Remarks that line out" and it won't be processed.

6. If none of this works, then you should go back into DOS and do the following:

CD \
edit  autoexec.bat

If you can't use the mouse, you have to use the "Alt" key in combination with the corresponding highlighted letter on any of the menu's eg. Alt and F will open the File menu.  Use the arrows to move up or down the menu, and the <enter> key to confirm your selection.

Look for any lines which say anything about that file name or folder name we have spoken about, and also for any lines containing reference to Mcaffee.

7. Arrow to the start of the line and type "rem" and a space.  Use Alt and F to open the file menu, then arrow to "Save" and press <enter>.  Use the Alt and F again and select "Exit" then <enter>

8. Back in DOS, just power off, remove the floppy and restart.

Come back here and tell us what's happened.

I forgot to show the <enter> after each of the lines in the block of commands, but each is clearly a new line and you should <enter> at the end of each, then type the next, etc.

If this fails, then I would really suggest formatting your hard drive and beginning a completely fresh installation of Windows.

Bill,

in your 1st step, what option do i need to choose to boot up when i insert the start up disk?

 F5 , or Shift + F5 , or Dos Prompt only??


so let me know if i understand correctly:

first you want me to twiddle with the recycled bin stuff.

if that doesnt work, then i should open up the autoexec bat file and put rem where needed.

right??

one more question, if we put rem anywhere in the autoexec bat file, do we need to do anything in the config.sys file?
or are they mutually exclusive?

Bill,

in your 1st step, what option do i need to choose to boot up when i insert the start up disk?

 F5 , or Shift + F5 , or Dos Prompt only??


so let me know if i understand correctly:

first you want me to twiddle with the recycled bin stuff.

if that doesnt work, then i should open up the autoexec bat file and put rem where needed.

right??

one more question, if we put rem anywhere in the autoexec bat file, do we need to do anything in the config.sys file?
or are they mutually exclusive?

If you are using a boot floppy created by Windows 98, you won't have to type anything in.  If you watch the screen, you will see it running through the process of loading some of its files temporarily onto your computer into what it refers to as a "Ram Drive", which is just a temporary folder which it will set as your D:\ Drive and push any other drives like a CD Rom Drive, etc up by one letter.  You don't have to worry about this, because you are only working on the C:\ Drive which will always stay as C:\.

I'm sure it will give you the option of starting with or without CD Rom Support.  Although you don't need this for what you're about to do, there's no harm in selecting WITH CD support.  All this does is load a driver into memory so that, if you wanted to, you could see what files were on your CD Rom disk if there was one loaded.  This is how you would install Windows.  If you WERE formatting your hard drive or reinstalling Windows, this is how you would do it.

In the first instance, the simple command "format C:" would be enough, after confirming you wanted to do so, to wipe your hard drive.

If you were installing Windows, you would find the drive letter for your CD Rom by changing between drives eg

D: <enter> would take you from C:\ to D:\ and you would see "D:\>" instead of ef "A:\>".

By using the DIR  /p  command, you will be able to see each drive's contents in turn.  Assuming you fould your Windows CD Rom on the E: drive, you would see:

.              <DIR>        16/01/03   5:14 .
..             <DIR>        16/01/03   5:14 ..
AUTORUN  INF            81  23/04/99  22:22 autorun.inf
CDSAMPLE       <DIR>        16/01/03   5:14 cdsample
DRIVERS        <DIR>        16/01/03   5:18 drivers
TOOLS          <DIR>        16/01/03   5:19 tools
WIN98          <DIR>        16/01/03   5:19 win98
ADD-ONS        <DIR>        16/01/03   5:21 add-ons
README   TXT         3,096  23/04/99  22:22 readme.txt
SETUP    EXE         3,824  23/04/99  22:22 setup.exe
SETUPTIP TXT         3,646  23/04/99  22:22 setuptip.txt
         5 file(s)         11,223 bytes
         7 dir(s)     976,003,072 bytes free

By typing the command "setup" you would start the installation.

Of course, once you knew that E: was the CD Rom, you could type the command from anywhere. Suppose you were in the A:\> Drive, you would just type:

E:\setup

to start installation.

Onto the subject in hand.  There's no harm in looking in autoexec.bat before you do anything with the recycle bin.  Autoexec.bat isn't protected in any way, so you don't have to use any "Attrib" commands to make and save any changes, so you might want to look at it first in "Read Only Mode" using:

Edit /R  autoexec.bat  <enter>

If you see any entries pertaining to Mcaffee, then just "remark" them out with a rem as discussed above.

You aren't really "twiddling" with the recycled folder, you're restoring the folder and file within it that you deleted to see if this allows you to boot.

Don't worry about config.sys for now, the two files may interact, but they aren't mutually exclusive.  It's a system file, so you would probably have to use the "attrib  -s  config.sys" command before using "edit config.sys", but if you are really despeate to have a look, feel free to open it in "Read only mode" again using "Edit  /r  config.sys"

My config.sys has these entries:

device=C:\WINDOWS\COMMAND\display.sys con=(ega,,1)
Country=044,850,C:\WINDOWS\COMMAND\country.sys

There are similarities with what it is setting, but it's in a different format.  Entries in this file can be "remarked out" by placing a semi-colon in front of the offending line rather than the letters "rem".

Let me know what happens when you restore the folder and file, and if you see anything odd in autoexec.bat (and config.sys if you have decided to have a look).

a new development.

i FOUND the windows product key, it was pasted on the underside of the notebook all the time!

but i do not have the win98CD for this note book.

now please let me know :

1. what will happen if i give the product key?

2. what is the system trying to do?

3. after i give the product key, will it ask for the win98
   CD or any other CD?

4. I have a HP PC also running on win98 and I have all the
   CDs and Product key and all the related stuff for this
   PC. after i give the notebook its actual product key
   can i use the win 98 CD of the PC instead?

      1. If you give the product key it will
        begin setup so long as you enter it
        letter for letter and number for number

      2.The product key is an activation key
        so that you can't install windows without
        it and if you have the key then you
        probably bought it and even if you didnt
        (pirating) you can activate it...So in
        answer the system isn't doing anything yet
       
      3. It will ask you for a cd ,if it already
          hadn't gotta get the files from somewhere
         
      4. You can use the win98 cd from your hp
         and the product key from your hp
         But you can't mix the hp cd and laptop
         product key or it won't work goes
         back too step number two.............

       So use the cd and product key from
       your hp in your notebook and it
       will work so long as all the keys
       are correct and entered correctly.

MS99

I'm sorry, I forgot that you originally said you didn't have the Win98 CD and clean forgot to ask you if you have the following folder on your computer:

C:\Windows\Options  which will contain all the .CAB files found on the Windows CD at CD\win98, but I'm sure it won't include "setup.exe".

The .CAB files alone won't actually allow you to INSTALL Windows again, but they are helpful if using the system file checker (sfc.exe) to restore any damaged or missing system files in the absence of a CD.

   
             Correct bill but in his last one
            I believe he said he had one for
            his hp so he can use that for his
            laptop since they're both under his name
            I have one win98 cd and three computers
            with it on it lol.


            Since you decided to do a format by
          yourself which thereby is fixing it yourself
          you might want a refund of points........


          glad I could help out on this........

Well, MS99, at least you know now how to resure items from your recycle bin in DOS - or is there anything I left out? :-)

        LOL,you covered it pretty thoroughly bill.
       That's alot of typing or cutting and pasting.

Man, this is a long post? If you've fixed your problem MS99, could you give somebody the points? Thanks.

Stephen

compu04, mostly typing offline then cut and paste, but I've condensed it for a straight paste next time :-)

LOL, Stephen I agree it took me 15+ min's to sort thru this one, but I'm not sure if the prob is solved.  I would like clarification on how removing Mcafee would cause w98 to lose its cd key/prod id from the registry.  Maybe the registry was so corrupted that it thought it was a new install?

Could you boot into safe mode?  Did you try doing a scanreg /fix, suggested by comp04?  Try that before trying the below to export & recreate your registry.

Export the registry into 2 text files & then recreate it from the text files, see below:
1) print these notes before doing, boot into dos make sure prompt is (& stays) c:\windows, & type the cmnds in quotes as is including spaces
2) "attrib -h -r -s user.dat" & "attrib -h -r -s system.dat"
2) "copy user.dat user.bkp" & "copy system.dat system.bkp"
3) below 2 steps export the registry dat files into text files & may take awhile depending on their size
3a) "regedit /L:user.dat /e c:\user.txt" (2-7mins)
3b) "regedit /L:system.dat /e c:\system.txt" (10-30mins)
4) "ren user.dat user.old" & "ren system.dat system.old"
5) below 2 steps recreate the registry dat files from the text files created above & may take awhile depending on their size
5a) "regedit /L:user.dat /c c:\user.txt"
5b) "regedit /L:system.dat /c c:\system.txt"

Note: to do the whole registry in 1 file sub these: for 3a&b "regedit /e c:\registry.txt"; for 5a&b "regedit /c c:\registry.txt"
Note2: 1) the "/L:" is to specify path location & which part of the registry (if your prompt is say "C:\" - ex: "/L:c:\windows\user.dat"); 2) the /e = export & the /c = create, without the /c will cause it to import from the text file not create a new file.

       Good point mimicsu I was thinking of that
       before as well, mcafee shouldnt mess with the
       registry product key or product Id ,which are in,
 
 hklm/software/microsoft/windows/current version

       If you can boot safe mode and somehow
       get on the internet or install a antivirus
       software off a cd then do it. Product key
       missing sounds like virus or corrupt registry
       as mimicsu metioned.

mimiscu

The original problem being addressed was the fact that the computer didn't boot.

"...installed McAfee firewall ...tried to uninstall it and something went wrong...removed using Add/Remove...saw a folder C:Mc??? ...thought it pertained to McAfee...deleted it to Recycle Bin...system now erratic... No "Stand By" option in Start Menu.... Chose "Restart"....system does not boot".

That was the problem I was addressing and the assumption was that McAffee had left a line in the registry or system file calling for contents, early on in boot sequence, of the missing folder and file. This was especially so after using scanreg /restore on an earlier backup.  By restoring this to see if system would boot, everything else could then be removed properly.

hello everyone,

sorry guys,I posted this reply last evening, but guess, it did not show up here,so, i am again posting this.

i corrected the problem and successfully rebooted to Windows without reinstalling/reformatting, no product key and no win98cd!

thanks to all of you who have taken so much interest and pains to help me out.

here is how i did it :

at the win98 screen, press F8, choose C prompt safe mode.

c:\md MCA33D4
cd MCA33D4
c:\MCA33D4\md MCFPLUS
c:\cd MCA33D4\cd MCFPLUS
c:\MCA33D4\MCFPLUS
c:\MCA33D4\MCFPLUS\copy c:\recycled\DC0.tmp\MCFPLUS\MC*.exe

as i was saying, i had that one good rb005.cab file left, so i used this one to scanreg /restore

this time i got the message, that windows has successfully restored the registry.

i booted and went straight thru into windows!

this means, at bootup,there is something somewhere, which was calling the MC*.exe file from the c:\MCA33D4\MCFPLUS\

now that I restored the directory and restored the registry, everything is fine.


now the questions are:

1. how do i find out what is calling this exe and from where?


I found the following entries relevent to McAfee in Microsoft System Information :

Software Environment
Start Up Programs
MCAgentExe |Registry (Ma...)|C:\ProgramFiles\MCAfee.com\Age...
MCUpdateExe|Registry (Ma...)|C:\Progra~1\MCAFEE.COM\AG...


Internet Explorer
Cache
List Of Objects
McAfee.com Operating System Class|Installed|4,0,0,8|http://....


If the above are creating the problem, how do i safely remove these?


2. how do i now safely delete this c:\MCA33D4\MCFPLUS\MC*.exe?

3. after booting into windows,the explorer opens up showing C:\Program
in the address bar.however, there are no files or folders.After I close
this explorer window, the desktop screen blinks once as if it is
refreshing.What does this mean?how do i remove this problem?

4. The system stalls while I am working on anything, especially, i have
noticed when i am online.the mouse stops responding, none of the
buttons work, i cannot even do Ctrl+Alt+Delete.I have to power off,
then it goes into scandisk, and repeats point 3 above.

5. I know some of the Toshiba models had the cooling fan problem.
In my system, the fan runs quite often,the fan-blades look to be
clean from outside and when I blow air into it, the fan rotates freely.
This problem has been there since the very beginning and is not a
new development.The bottom of the notebook seems to be a little
warmer and sometimes it gets quite warm. Anything to do with the
AMD?



System Information for this Toshiba 2180 CDT notebook:

Authentic AMD AMD-K6™ 3D processor
64 MB RAM
79% system resources free
Windows-managed swap file on drive C (1646 MB free)
Available space in drive C: 1646 MB of 4117 MB (FAT32)


Control Panel
System
System Properties :

Memory: 64.0 MB of RAM
System Resources: 75% Free
File System: 32-bit
Virtual Memory: 32-bit
Disk Compression: Not Installed
PC Cards(PCMCIA): 32-bit

"Your System is configured for optimal performance"

Any suggestions for all the above questions?

hello everyone,

sorry guys,I posted this reply last evening, but guess, it did not show up here,so, i am again posting this.

i corrected the problem and successfully rebooted to Windows without reinstalling/reformatting, no product key and no win98cd!

thanks to all of you who have taken so much interest and pains to help me out.

here is how i did it :

at the win98 screen, press F8, choose C prompt safe mode.

c:\md MCA33D4
cd MCA33D4
c:\MCA33D4\md MCFPLUS
c:\cd MCA33D4\cd MCFPLUS
c:\MCA33D4\MCFPLUS
c:\MCA33D4\MCFPLUS\copy c:\recycled\DC0.tmp\MCFPLUS\MC*.exe

as i was saying, i had that one good rb005.cab file left, so i used this one to scanreg /restore

this time i got the message, that windows has successfully restored the registry.

i booted and went straight thru into windows!

this means, at bootup,there is something somewhere, which was calling the MC*.exe file from the c:\MCA33D4\MCFPLUS\

now that I restored the directory and restored the registry, everything is fine.


now the questions are:

1. how do i find out what is calling this exe and from where?


I found the following entries relevent to McAfee in Microsoft System Information :

Software Environment
Start Up Programs
MCAgentExe |Registry (Ma...)|C:\ProgramFiles\MCAfee.com\Age...
MCUpdateExe|Registry (Ma...)|C:\Progra~1\MCAFEE.COM\AG...


Internet Explorer
Cache
List Of Objects
McAfee.com Operating System Class|Installed|4,0,0,8|http://....


If the above are creating the problem, how do i safely remove these?


2. how do i now safely delete this c:\MCA33D4\MCFPLUS\MC*.exe?

3. after booting into windows,the explorer opens up showing C:\Program
in the address bar.however, there are no files or folders.After I close
this explorer window, the desktop screen blinks once as if it is
refreshing.What does this mean?how do i remove this problem?

4. The system stalls while I am working on anything, especially, i have
noticed when i am online.the mouse stops responding, none of the
buttons work, i cannot even do Ctrl+Alt+Delete.I have to power off,
then it goes into scandisk, and repeats point 3 above.

5. I know some of the Toshiba models had the cooling fan problem.
In my system, the fan runs quite often,the fan-blades look to be
clean from outside and when I blow air into it, the fan rotates freely.
This problem has been there since the very beginning and is not a
new development.The bottom of the notebook seems to be a little
warmer and sometimes it gets quite warm. Anything to do with the
AMD?



System Information for this Toshiba 2180 CDT notebook:

Authentic AMD AMD-K6™ 3D processor
64 MB RAM
79% system resources free
Windows-managed swap file on drive C (1646 MB free)
Available space in drive C: 1646 MB of 4117 MB (FAT32)


Control Panel
System
System Properties :

Memory: 64.0 MB of RAM
System Resources: 75% Free
File System: 32-bit
Virtual Memory: 32-bit
Disk Compression: Not Installed
PC Cards(PCMCIA): 32-bit

"Your System is configured for optimal performance"

Any suggestions for all the above questions?

   1. Your program might be calling from
      config.sys or autoexec.bat check for any
      mcafee entries in there usually mcafee
      puts something in there.Check for mcafee
      in your registry as well but don't delete
      any entries out of the registry.Check msconfig
      startup tab let us know whats running in there.
      Let me know what you find.

   2. No telling that there is a safe way to
      delete that. I mean you did it once and
      it went haywire on you. Unless you can find
      that there are no system files tied in.
      Since you said it was just the folder you
      can't do add remove programs. You might consult
      McAfee again about this issue.

   3. Blinking once sounds like an icon refresh
      issue. Go into c:/windows                     view/folderoptions/view/   show all files.
       delete shellconcache and reboot it will
       rebuild and clean up on startup

   4. You might want too invest in some more RAM
      at least 128 but no more than 512, 256 is good
      (two 128 sticks)Windows 98 just hates anything under
      128 after running a few programs and with windows
      already running shell based memory applications
      64 goes faster than the speed of light

   5. Clean out your fan with air while the computer
      is off. if your fan is'nt always working sufficently
      You might look too investing in a new one
      as broken or 1/2 working fans are a nightmare
      for hardware especially if it's your power
      supply fan that is doing this.
     

Use the Start > Run option and type MSINFO32.
Go to "Software Environment" in the left pane and click on each entry in turn looking for running tasks, etc.  Each entry usually shows where it was invoked from and through what file.

You can use the Edit > Select All > Edit > Copy option to paste each section into NotePad or Word for printing, if that's easier.

Using Start > Run > SYSEDIT will produce a utility showing most of the system files which MAY have something to do with this.

Just remember this, To "remark out" an entry in a system file like these, use the following at the start of the relevant line:

.BAT files use "rem" (without the " ")
.INI files use a semicolon ;
.SYS files (if viewable in NotePad) use a semicolon ;

It is safer to "remark out" an entry than to delete it, as you can always get to DOS via your boot disk and use "EDIT" to change it back.

Remove the line which is calling the MCAFFEE item and attempt to reboot.  It won't be in use then, and can be renamed to something else to test things out.  If that works, then move it to another folder and test again.
Delete it if everything else has gone fine for several weeks.

Your other problems are possibly because of a corrupt system file, but the symptoms are too vague to diagnose.

Just one question to you.  How did you know that there was a sub-folder MCFPLUS in the folder MCA33D4? Furthermore, how did you know that the MC??? was an exe file, and what name has it restored under.

I think you have had to go back to the 5th registry backup cab file because, each time you run scanreg, it backs up the registry and has backed up 4 bad boots.  By good fortune, I think you have caught No. 5 before it was replaced by No. 4.

billdl
"The original problem being addressed was the fact that the computer didn't boot."

well also in the orig ? it said "Now the problem has cropped up.The system does not boot, after the Windows98 screen appears,it asks for the Product Key(I guess the Win98 Key)"

i suggested booting into safe mode, because no one had suggested trying earlier, seems it helped since he was able to boot using "safe mode cmnd prompt only" instead of a bootdisk.  then he was able to follow your instructions about restoring files from the recycle bin.

ms99
start-run-msconfig-startup tab- & uncheck mcafee jobs.
following my instructions about rebuilding the registry should help get rid of errors, but like i said you should try doing the scanreg /fix first.

Your #3 about a blank explorer window opening up is probably related to your #1.  Does it look like it is trying to find a program to start?  In other words, if a pgm is set to start, but it can't find the .exe, it normally displays an explorer window for the user to browse & select the file.

As far as your #4 goes, I think you should try installing w98 on top of itself in the same directory, else: bkup your data, format, & do a clean install.

helo ms99, have you tried anything recently???

Hello everyone,

Sorry, I havent logged in a while.

I have not done anything to remove the McAfee folder which created the problem.

I ran MSINFO32 and under StartUp Programs, I found two entries


MCAgent.exe  Registry(Ma.. C:\ProgramFiles\McAfee.com\AG..
MCUpdate.exe Registry(Ma.. C:\Progra~1\MCAFEE.COM\AG..

I guess the second is responsible for the blank explorer being opened.It just opens the explorer and does not do anything(no file searching or anything).It just keeps quiet after opening.I close this and go about with my business with no more problems.

I ran sysedit,but did not find any entry which might have to do with McAfee.

When I booted to DOS, I gave

C:\MCA33D4\MCFPLUS\copy c:\recycled\DC0.tmp\MCFPLUS\MC*.exe

I got error.

Then I used C:\recycled\cd DC0.tmp

"File not found... blah blah blah.."

I got this error 5-6 times.But suddenly(I dont remember having done any magic),it let me into DC0.tmp

when I gave C:\recycled\dmp0.tmp\dir , it showed me the dir of MCFPLUS, then I did cd MCFPLUS and dir, then it showed the MC*.exe file!

Thats how I came to know of all these folders and subfolders and ultimately the MC*.exe file.Then the rest was easy as described in my earlier post.

1.

Now if I run msconfig, is it safe to uncheck the McAfee related boxes? what will happen if I am unable to boot after doing this? Will I be able to correct this thru DOS??


2.

compu04 suggested :". Blinking once sounds like an icon refresh issue. Go into c:/windows view/folderoptions/view/   show all files.delete shellconcache and reboot it will rebuild and clean up on startup"

do you think this would work?what happens if i am unable to boot after I do this?can I correct this thru DOS then?

I forgot to add some information  regarding:


I ran MSINFO32 and under StartUp Programs, I found two entries


MCAgent.exe  Registry(Ma.. C:\ProgramFiles\McAfee.com\AG..
MCUpdate.exe Registry(Ma.. C:\Progra~1\MCAFEE.COM\AG..


I checked for the above thru windows explorer.

In C:\there is a folder called Programs but there are no files or sub-folders under this.This is what is opening right after the boot.

There is another folder like:

C:\ProgramFiles\McAfee.com\Personal Firewall\Install.log

There is only this install.log file in the above folders.

The Registry is attempting to run these applications.

1. Open RegEdit using Start > Run > and type REGEDIT.
Use the menu "Edit > Find" and type in MCAgent.exe then let it search for that occurrence.
2. When it finds the entry, it will open with the key "sub-folder) containing it in the left pane.
3. Click on the "parent key" above it to highlight it.
4. Use the following menu options:
   (a) Registry > Export Registry File >
   (b) Browse to your desktop or some other folder which you would be able to access with DOS
   (c) Type in a suitable name eg: "agent"
   (d) make sure "selected registry branch" only is checked
   (e) Click "Save" and it will save this as "agent.reg".
  This file will allow this registry key to be restored from DOS or Windows (by double-clicking) if you need to.
5. Do the same "Edit > Find" for "MCUpdate.exe" and save it as "update.reg" to your desktop.

Close RegEdit without making any changes anywhere.

6. Make copies of the 2 .REG files and rename the copies as .TXT instead of .REG.
7. Open them in NotePad, copy the contents, and paste them here.

I will then advise you how to remove these entries so that the executables won't be looked for.

If you do feel confident in making any changes yourself, generally what you want to try first is deleting the actual "Value" which will be set to the path "C:\ProgramFiles\McAfee.com...etc".

The value will probably be a small white square shaped icon in the right-hand pane with burgundy coloured "ab" in it.  It may be named something like "[default]" or perhaps some other name.

By right-clicking on it, you will find the "delete" option.

Don't try this is you haven't a clue, far rather paste the contents here and I will advise you.

DON'T Delete any of the McAffee files restored until the registry entry is removed, or you will get the same problem again.

I should have said.

Resume the search in RegEdit once you have found and saved the respective key until it tells you that it has reached the end.

Save any additional keys that it finds as eg "update2.reg", "update3.reg" etc.

to do an Edit > Find next, just use the F3 key.

Once finished searching for the first executable, scroll back so that the topmost item  "My Computer" is highlighted so that it searches the entire registry again, not just from where you found the last entry.

I ran regedit

Find - McAfee

deleted EVERYTHING related to McAfee what ever I found!
including McAgent and McUpdate.

SUCCESSFULLY REBOOTED.

I rebooted twice and both times there was no problem.

After successful boot tomorrow, I am going to delete the Mpfplus.exe file which had created the problem the last time I deleted it.

This time, I dont think there will be any problem if I delete this file.

I will post the result tomorrow.

MS99,
You ignored trying to fix & rebuild the registry as I posted on 4/28, as well a my advice on 4/29 to uncheck the mcafee jobs from within msconfig to prevent them from starting up.  Apparently my stmt on 5/3 helped you to figure out that it was trying to find an app that wasn't there anymore, but it also said you should reinstall windows (clean install preferred).

Even though it seems that you may have temporarily fixed the prob, by deleting out registry entries for mcafee, you should still run "scanreg /fix".

mimicsu

Tomorrow after I delete the Mcfplus.exe and see its effects, I will run scanreg /fix as suggested by you.

You were right that it was trying to find some app.

After I deleted all the mcafee-related entries in the Registry,and rebooted,that empty explorer and the screen-refresh problems are both gone.

Well done MS99. Now that you have a bootable PC, use RegEdit to export a .REG file of your FULL registry BEFORE doing any other registry fixes.

Save the .REG file with a name less that 8 letters and save it somewhere with folder names where you can easily find it in DOS if the registry fix goes wrong or is overzealous in removing what it sees as "orphan entries" (as has happened with me several times before).

A good place would be C:\Windows\Desktop\fullreg.reg.

You should ensure that the startup tab in MSCONFIG shows the following line under "Scan Registry":
C:\Windows\scanregw.exe /autorun.
(This is the Windows version of DOS scanreg.exe).

http://www.compguystechweb.com/troubleshooting/windows/registry_checker.html

Quote: "Windows Registry Checker automatically scans the system registry for invalid entries and empty data blocks when it is started. If invalid registry entries are detected, Windows Registry Checker automatically restores a previous day's backup. This is equivalent to running "scanreg /autorun" (without quotation marks) from a command prompt. If no backups are available, Windows Registry Checker tries to make repairs to the registry. This is equivalent to running "scanreg /fix" (without quotation marks) from a command prompt. If the registry contains more than 500K of empty data blocks, Windows Registry Checker automatically optimizes it".

Hello Bill

Thanks for your inputs.

I already exported the full registry and made copies of all the rb*.cab files in C:\Backups.

I will export the full registry to the desktop as well as suggested by you(fullreg.reg).

I confirmed that sanregw.exe exists under StartUp in MSCONFIG.

If something goes wrong during scanreg /fix and I am unable to boot,

1.

Do I need to manually copy the fullreg.reg from the desktop to anywhere or do I just need to run scanreg /restore? and the system will automatically restore the registry to where it should be?

2.

WHERE AND AS WHAT NAME should I copy the full registry file(fullreg.reg) from the desktop(if need be)??
And what should I do next?


3.

Where and under what name does the good registry reside in the system?


I would like to know these before I attempt anything.

MS99, here's a brief tutorial to print off for reference:

The physical files that make up the registry are stored as two hidden files in your Windows directory, called USER.DAT and SYSTEM.DAT.  These files are NOT directly editable in something like NotePad.  RegEdit merely provides a user friendly interface to both these files.

The reason I suggested saving the .REG file to your desktop is that the full path (assuming you are the only login profile) C:\Windows\Desktop uses names which will be accessible in DOS ie. 8 characters or less, and therefore won't be abbreviated like C:\Windows\Tempor~1 (C:\Windows\Temporary Internet Files).  Even if long file/foldernames are usable in the DOS application, any spaces in file or foldernames would then normally require " " to enclose the full path.  You are therefore limiting any chances of leaving out something by sticking to short names.

Just leave the .REG file where it is. Don't open it (ie. Right-Click > Edit), because it will be too large for NotePad and will open with WordPad which can occasionally upset formatting if the file is resaved in WordPad.

The command line syntax for RegEdit is:

regedit.exe [options] [filename]

filename   Import .reg file into the registry
/s         Silent, i.e. hide confirmation box when importing files
/e         Export registry file
           e.g. regedit /e file.reg HKEY_USERS\.DEFAULT
/L:system  Specify the location of the system.dat to use
/R:user    Specify the location of the user.dat to use
/C         Compress [filename] (Windows 98)

If you ever did need to import it back into the registry as a result of a failed boot, you have 2 options:

In the Windows directory there are several hidden files, four of these will be SYSTEM.DAT & USER.DAT, your current registry, and SYSTEM.DA0 & USER.DA0 (zero's), a backup of your registry. Windows 9x has a nice feature in that every time it appears to start successfully it will copy the registry over these backup files, so just in case something goes wrong can can restore it to a known good state. To restore the registry follow these instruction:

1. Boot to DOS
2. Change to your Windows directory. For example, if your Windows directory is c:\windows, you would type the following:

   cd c:\windows

3. Type the following commands, pressing ENTER after each one.

attrib  -h  -r  -s  system.dat
attrib  -h  -r  -s  system.da0
copy  system.da0  system.dat
attrib  -h  -r  -s  user.dat
attrib  -h  -r  -s  user.da0
copy  user.da0  user.dat

4. Restart your computer.

Following this procedure will restore your registry to its state when you last successfully started your computer.

If all else fails, there is a file on your hard disk named SYSTEM.1ST that was created when Windows 95 was first successfully installed. If necessary you could also change the file attributes of this file from read-only and hidden to archive to copy the file to C:\WINDOWS\SYSTEM.DAT.

The other option is to "import" your full registry export (the .REG file you saved to your desktop) into the registry.

    regedit.exe  c:\windows\desktop\filename.reg

This will overwrite any duplicate entries and write fresh ones if they no longer exist.

Of course, if you can get into Windows, all you have to do is double-click on the .reg file, or open Regedit and use the menu "Registry > Import" option and browse to your .reg file.  The changes will be effected when you reboot.

Hope this helps.

 

Done!

I successfully ran the scanreg /fix and booted up.No Problems of any kind.

Thanks to everyone who has helped.

Good for you MS99. Hope you aren't plagued with problems like this again.

Lesson learned? Backup before delete :-)

You now face the further problem of deciding which comments helped you the most. If you feel that one singled out and corrected the problem, then just accept the comment and allocate a grading.  If there were several, and you would like to split points, place a zero points comment on the "Community Support" board titled something like "Administrators, please split points". Post the url of this page in there as a reference, and detail how you would like points allocated and what gradings should be awarded.

Points should be divided between:
COMP04 4/24 - "scanreg /fix"
BILLDL 4/24 - recovering recycle bin files from dos

I helped with determining that it was looking for a program it couldn't find, checking startup jobs in msconfig, & how to extract the registry thru DOS.  Even though I helped the above 2 expert's comments solved the problem.

Hello BillDl, Comp04 and mimicsu

I have no clue as to how this points system works.

I would request the Admn in the support section to split points between you three.

For this , I should know how many points I have.

There is an option for me which says:

 1. Increase points to : 50
 2. Edit Question....
 3. Post a Comment

What is this 50?Can I increase these points?Or do I need to split this 50 only?

Hello BillDl, Comp04 and mimicsu

I have no clue as to how this points system works.

I would request the Admn in the support section to split points between you three.

For this , I should know how many points I have.

There is an option for me which says:

 1. Increase points to : 50
 2. Edit Question....
 3. Post a Comment

What is this 50?Can I increase these points?Or do I need to split this 50 only?

Hello BillDl, Comp04 and mimicsu

I have no clue as to how this points system works.

I would request the Admn in the support section to split points between you three.

For this , I should know how many points I have.

There is an option for me which says:

 1. Increase points to : 50
 2. Edit Question....
 3. Post a Comment

What is this 50?Can I increase these points?Or do I need to split this 50 only?

MS99, don't worry about including me in the points.  It complicates things for you and I'm glad you are sorted out now.

I have a creeping suspicion that comp04's scanreg /fix may have worked, but things were already underway to get the stuff restored from your recycle bin to get you booted up. I also overlooked mimiscu's valid Safe Mode suggestion in my command-line syntax-driven thought processes.

Please just split points between mimiscu and comp04.  Howz about 25 points each to round it off.

Well honestly, with no disrespect to the efforts of compu and mimi, I guess it was Bill's suggestion that actually worked.I was able to boot thru the boot disk and work in DOS.So, starting in Safe mode was really not that much helpful.Next,scanreg /fix was not that important and vital to restore my system.It was just to clean up the registry of all the unwanted entries after successful bootup.

I guess ultimately,Bill helped the most taking care to reply immediately and taking pains to reply in a most detailed and patient manner.

Hence guys,I am gonna give it to Bill.

PS: I cannot kick my habit of tampering my computers,so I am bound to get more problems and sure to hit this deck before long.At that time,I guess I can give points to my other friends.

        Just glad you got it fixed. All the advice
        was good.Honestly I dont even answer
        for points I just love computers....call me
        crazy lol  good luck in all your future
        computing...

        Just glad you got it fixed. All the advice
        was good.Honestly I dont even answer
        for points(thats just a bonus,ego points I
        call them lol.Good luck in all
        your future computing...

Bill, did you get the 50 points?

Compu, thanks.