Solved

Desktop popup with every start up/reboot says "The Registration wizard cannot run because .."

Posted on 2007-11-29
21
1,134 Views
Last Modified: 2008-02-01
Not sure if I accidentally deleted something or what but I am getting a pop up every time I start my PC that appears on the desktop which says:  "The Registration wizard cannot run because the information it requires from the system is either unavailable or incorrect."

I've been running XP Pro for four years on this PC so it's not like it isn't registered.  I am not sure even what it's referring to, because I have not installed any software for months.

Would like to figure out how to stop the pop up which btw, does not seem to affect anything with the machine, or its performance.
0
Comment
Question by:wgrogers
  • 8
  • 7
  • 3
  • +2
21 Comments
 
LVL 17

Expert Comment

by:JohnGerhardt
ID: 20375081
Wack you Win XP CD and then choose Start => Run type "sfc /scannow". See if it picks up the problem.
Get back to me...
-Jaggie
0
 

Author Comment

by:wgrogers
ID: 20375344
Oh, that's right.  I did that yesterday and nothing changed.  Also tried a system restore but no help.

-Greg
0
 

Expert Comment

by:replylalit
ID: 20375856
Try to get the program/process which is showing you the registration message box.
Get the name of it from task manager and kill the same.

Then go to Services.msc and check if the process is there as a service, if it is make its startup a manual startup which currently would be automatic.

This is harmful and your system is running in a good way, so this should be done.
0
 
LVL 4

Expert Comment

by:superfooz74
ID: 20376098
it might be referring to Office

http://support.microsoft.com/kb/236592
0
 
LVL 4

Expert Comment

by:superfooz74
ID: 20376118
0
 

Author Comment

by:wgrogers
ID: 20376472
replylalit:

I rebooted and got the popup, opened task manager.  Under "Applications" it just shows "Registration Wizard"  Status=Running.  If I switch to "Processes", then drag the pop up around the desktop, I see CPU usage increase for regwiz.exe and explorer.exe.  Should I locate regwiz.exe and delete it?
0
 
LVL 4

Expert Comment

by:superfooz74
ID: 20377007
Even if you delete the process, it will pop up next time you reboot. It seems that for some reason, your copy of XP thinks it is not registered.

I would try to re-register it, instructions here
http://www.helpline4it.com/lab_practices-d497.html

if it gives you a problem you could try calling Microsoft, i think they give you a number to cal lif registration fails
0
 

Author Comment

by:wgrogers
ID: 20378720
MS says if the OS is OEM product to contact mfg.  I contacted Dell and they said it's an OS issue, contact MS.  Catch-22 I guess.
0
 
LVL 22

Expert Comment

by:orangutang
ID: 20379724
Also, send us your HijackThis (http://www.trendsecure.com/portal/en-US/threat_analytics/hijackthis.php) or your Autoruns (http://www.microsoft.com/technet/sysinternals/Utilities/AutoRuns.mspx) log. Paste it with "Attach Code Snippet".
0
 

Author Comment

by:wgrogers
ID: 20380407
Here is HJT log
Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:42:02 PM, on 11/29/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal
 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\wwSecure.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Logitech\iTouch\iTouch.exe

C:\Program Files\QuickTime\qttask.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2K1.EXE

C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2K1.EXE

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\Program Files\Logitech\MouseWare\system\em_exec.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBPA.EXE

C:\Program Files\Skype\Plugin Manager\skypePM.exe

C:\Documents and Settings\Administrator\Desktop\HiJackThis.exe
 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Documents%20and%20Settings/Administrator/Desktop/index.html

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\regwiz.exe,

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe

O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [Firewall auto setup] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winlogon.exe

O4 - HKUS\S-1-5-18\..\RunOnce: [ati] C:\Documents and Settings\LocalService\scvhost.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [ati] C:\Documents and Settings\LocalService\scvhost.exe (User 'Default user')

O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll

O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll

O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe

O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

O16 - DPF: Web-Based Email Tools - http://email.secureserver.net/Download.CAB

O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} (DownloadManager Control) - http://dlmanager.akamaitools.com.edgesuite.net/dlmanager/versions/activex/dlm-activex-2.0.5.0.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1139736399187

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - https://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab

O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab

O16 - DPF: {BA5E57BB-88D5-422A-AC9E-C01A6EEE2537} (WebDvr3 Class) - http://192.168.2.3/WebDvr3.cab

O16 - DPF: {E991BDE0-9816-4094-853E-6BDB60F0342D} (Get_ActiveX Control) - http://apps.corel.com/nos_dl_manager/plugin/IENetOpPlugin.ocx

O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs: ??????????????? C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll

O21 - SSODL: bvkVkFKQCf - {0C77B44C-A6DD-1EE6-7A22-7E584FD1DCF8} - C:\WINDOWS\system32\adgbjl.dll (file missing)

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe

O23 - Service: Washer Security Access (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\System32\wwSecure.exe
 

--

End of file - 6913 bytes

Open in new window

0
How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

 
LVL 22

Expert Comment

by:orangutang
ID: 20380427
This seems like the cause:
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\regwiz.exe,
0
 
LVL 22

Expert Comment

by:orangutang
ID: 20380448
I would also suggest scanning with SUPERAntiSpyware (http://www.superantispyware.com/downloadfile.html?productid=SUPERANTISPYWAREFREE) because you have some spyware.
0
 
LVL 22

Expert Comment

by:orangutang
ID: 20380460
Actually, it doesn't really seems like you have spyware but you should scan just in case and correct this:
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\regwiz.exe,
0
 

Author Comment

by:wgrogers
ID: 20380492
So you are saying run HJT and check F2 then Fix Checked?  
What about 010 - Unknown file in Winsock LSP?
Also, 021 - SSODL adgbjl.dll (file missing)?

Are those safe to delete?

Thanks
0
 

Expert Comment

by:replylalit
ID: 20383184
Try to rename this file,  and check what happens

C:\WINDOWS\system32\regwiz.exe
rename to regwiz_x.exe
0
 

Author Comment

by:wgrogers
ID: 20383424
If I rename it or even change the extension, after I reboot it reappears in the system32 folder.
0
 
LVL 22

Expert Comment

by:orangutang
ID: 20383699
Did you scan with SUPERAntiSpyware? I'm not sure how to fix:
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\regwiz.exe,
Have you tried checking it and fixing it in HijackThis? I think you should be able to remove the entire line.
0
 
LVL 22

Expert Comment

by:orangutang
ID: 20383714
Actually, open regedit to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
and make sure the "Userinit" value is:
C:\WINDOWS\system32\userinit.exe,
I'm not sure why it says "system.ini", though.
0
 

Author Comment

by:wgrogers
ID: 20384733
I have not scanned with SAS.  Scanned with Kaspersky.  Don't want to modify anything unless you're sure what it is and what it will affect.  I'm not all that experienced with the effects of changing and deleting these kinds of things so want to avoid more problems.  I don't understand though why running sfc /scannow with the OS disc didn't change the "registration"?

Anyway, thanks for help.
0
 
LVL 22

Accepted Solution

by:
orangutang earned 500 total points
ID: 20385004
Okay, open regedit to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Right-click the key, click "Export", save the backup with any name you want.
Make sure the "Userinit" value is:
C:\WINDOWS\system32\userinit.exe,
0
 

Author Comment

by:wgrogers
ID: 20385291
Well what do you know?  I changed the registry value and voilà!  No more pop up!!  Best points I've spent in a while.  Thank you for your help.
0

Featured Post

Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

Join & Write a Comment

INTRODUCTION The purpose of this document is to demonstrate the Installation and configuration of the Data Protection Manager product. Note that this demonstration was prepared on the basis of Windows OS is 2008 R2 and DPM 2010. DATA PROTECTI…
When you start your Windows 10 PC and got an "Operating system not found" error or just saw  "Auto repair for startup". After a while, you have entered a loop for Auto repair which does not fix anything and you will be in a  panic as all your work w…
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now