Solved

Desktop popup with every start up/reboot says "The Registration wizard cannot run because .."

Posted on 2007-11-29
21
1,183 Views
Last Modified: 2008-02-01
Not sure if I accidentally deleted something or what but I am getting a pop up every time I start my PC that appears on the desktop which says:  "The Registration wizard cannot run because the information it requires from the system is either unavailable or incorrect."

I've been running XP Pro for four years on this PC so it's not like it isn't registered.  I am not sure even what it's referring to, because I have not installed any software for months.

Would like to figure out how to stop the pop up which btw, does not seem to affect anything with the machine, or its performance.
0
Comment
Question by:wgrogers
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 8
  • 7
  • 3
  • +2
21 Comments
 
LVL 17

Expert Comment

by:JohnGerhardt
ID: 20375081
Wack you Win XP CD and then choose Start => Run type "sfc /scannow". See if it picks up the problem.
Get back to me...
-Jaggie
0
 

Author Comment

by:wgrogers
ID: 20375344
Oh, that's right.  I did that yesterday and nothing changed.  Also tried a system restore but no help.

-Greg
0
 

Expert Comment

by:replylalit
ID: 20375856
Try to get the program/process which is showing you the registration message box.
Get the name of it from task manager and kill the same.

Then go to Services.msc and check if the process is there as a service, if it is make its startup a manual startup which currently would be automatic.

This is harmful and your system is running in a good way, so this should be done.
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 4

Expert Comment

by:superfooz74
ID: 20376098
it might be referring to Office

http://support.microsoft.com/kb/236592
0
 
LVL 4

Expert Comment

by:superfooz74
ID: 20376118
0
 

Author Comment

by:wgrogers
ID: 20376472
replylalit:

I rebooted and got the popup, opened task manager.  Under "Applications" it just shows "Registration Wizard"  Status=Running.  If I switch to "Processes", then drag the pop up around the desktop, I see CPU usage increase for regwiz.exe and explorer.exe.  Should I locate regwiz.exe and delete it?
0
 
LVL 4

Expert Comment

by:superfooz74
ID: 20377007
Even if you delete the process, it will pop up next time you reboot. It seems that for some reason, your copy of XP thinks it is not registered.

I would try to re-register it, instructions here
http://www.helpline4it.com/lab_practices-d497.html

if it gives you a problem you could try calling Microsoft, i think they give you a number to cal lif registration fails
0
 

Author Comment

by:wgrogers
ID: 20378720
MS says if the OS is OEM product to contact mfg.  I contacted Dell and they said it's an OS issue, contact MS.  Catch-22 I guess.
0
 
LVL 22

Expert Comment

by:orangutang
ID: 20379724
Also, send us your HijackThis (http://www.trendsecure.com/portal/en-US/threat_analytics/hijackthis.php) or your Autoruns (http://www.microsoft.com/technet/sysinternals/Utilities/AutoRuns.mspx) log. Paste it with "Attach Code Snippet".
0
 

Author Comment

by:wgrogers
ID: 20380407
Here is HJT log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:42:02 PM, on 11/29/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
 
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\wwSecure.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2K1.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2K1.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBPA.EXE
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Documents and Settings\Administrator\Desktop\HiJackThis.exe
 
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Documents%20and%20Settings/Administrator/Desktop/index.html
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\regwiz.exe,
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Firewall auto setup] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winlogon.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [ati] C:\Documents and Settings\LocalService\scvhost.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [ati] C:\Documents and Settings\LocalService\scvhost.exe (User 'Default user')
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: Web-Based Email Tools - http://email.secureserver.net/Download.CAB
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} (DownloadManager Control) - http://dlmanager.akamaitools.com.edgesuite.net/dlmanager/versions/activex/dlm-activex-2.0.5.0.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1139736399187
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - https://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {BA5E57BB-88D5-422A-AC9E-C01A6EEE2537} (WebDvr3 Class) - http://192.168.2.3/WebDvr3.cab
O16 - DPF: {E991BDE0-9816-4094-853E-6BDB60F0342D} (Get_ActiveX Control) - http://apps.corel.com/nos_dl_manager/plugin/IENetOpPlugin.ocx
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: ??????????????? C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O21 - SSODL: bvkVkFKQCf - {0C77B44C-A6DD-1EE6-7A22-7E584FD1DCF8} - C:\WINDOWS\system32\adgbjl.dll (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: Washer Security Access (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\System32\wwSecure.exe
 
--
End of file - 6913 bytes

Open in new window

0
 
LVL 22

Expert Comment

by:orangutang
ID: 20380427
This seems like the cause:
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\regwiz.exe,
0
 
LVL 22

Expert Comment

by:orangutang
ID: 20380448
I would also suggest scanning with SUPERAntiSpyware (http://www.superantispyware.com/downloadfile.html?productid=SUPERANTISPYWAREFREE) because you have some spyware.
0
 
LVL 22

Expert Comment

by:orangutang
ID: 20380460
Actually, it doesn't really seems like you have spyware but you should scan just in case and correct this:
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\regwiz.exe,
0
 

Author Comment

by:wgrogers
ID: 20380492
So you are saying run HJT and check F2 then Fix Checked?  
What about 010 - Unknown file in Winsock LSP?
Also, 021 - SSODL adgbjl.dll (file missing)?

Are those safe to delete?

Thanks
0
 

Expert Comment

by:replylalit
ID: 20383184
Try to rename this file,  and check what happens

C:\WINDOWS\system32\regwiz.exe
rename to regwiz_x.exe
0
 

Author Comment

by:wgrogers
ID: 20383424
If I rename it or even change the extension, after I reboot it reappears in the system32 folder.
0
 
LVL 22

Expert Comment

by:orangutang
ID: 20383699
Did you scan with SUPERAntiSpyware? I'm not sure how to fix:
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\regwiz.exe,
Have you tried checking it and fixing it in HijackThis? I think you should be able to remove the entire line.
0
 
LVL 22

Expert Comment

by:orangutang
ID: 20383714
Actually, open regedit to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
and make sure the "Userinit" value is:
C:\WINDOWS\system32\userinit.exe,
I'm not sure why it says "system.ini", though.
0
 

Author Comment

by:wgrogers
ID: 20384733
I have not scanned with SAS.  Scanned with Kaspersky.  Don't want to modify anything unless you're sure what it is and what it will affect.  I'm not all that experienced with the effects of changing and deleting these kinds of things so want to avoid more problems.  I don't understand though why running sfc /scannow with the OS disc didn't change the "registration"?

Anyway, thanks for help.
0
 
LVL 22

Accepted Solution

by:
orangutang earned 500 total points
ID: 20385004
Okay, open regedit to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Right-click the key, click "Export", save the backup with any name you want.
Make sure the "Userinit" value is:
C:\WINDOWS\system32\userinit.exe,
0
 

Author Comment

by:wgrogers
ID: 20385291
Well what do you know?  I changed the registry value and voilà!  No more pop up!!  Best points I've spent in a while.  Thank you for your help.
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

An introduction to the wonderful sport of Scam Baiting.  Learn how to help fight scammers by beating them at their own game. This great pass time helps the world, while providing an endless source of entertainment. Enjoy!
Ever visit a website where you spotted a really cool looking Font, yet couldn't figure out which font family it belonged to, or how to get a copy of it for your own use? This article explains the process of doing exactly that, as well as showing how…
In this video, viewers will be given step by step instructions on adjusting mouse, pointer and cursor visibility in Microsoft Windows 10. The video seeks to educate those who are struggling with the new Windows 10 Graphical User Interface. Change Cu…
If you’ve ever visited a web page and noticed a cool font that you really liked the look of, but couldn’t figure out which font it was so that you could use it for your own work, then this video is for you! In this Micro Tutorial, you'll learn yo…

630 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question