Solved

Desktop popup with every start up/reboot says "The Registration wizard cannot run because .."

Posted on 2007-11-29
21
1,154 Views
Last Modified: 2008-02-01
Not sure if I accidentally deleted something or what but I am getting a pop up every time I start my PC that appears on the desktop which says:  "The Registration wizard cannot run because the information it requires from the system is either unavailable or incorrect."

I've been running XP Pro for four years on this PC so it's not like it isn't registered.  I am not sure even what it's referring to, because I have not installed any software for months.

Would like to figure out how to stop the pop up which btw, does not seem to affect anything with the machine, or its performance.
0
Comment
Question by:wgrogers
  • 8
  • 7
  • 3
  • +2
21 Comments
 
LVL 17

Expert Comment

by:JohnGerhardt
ID: 20375081
Wack you Win XP CD and then choose Start => Run type "sfc /scannow". See if it picks up the problem.
Get back to me...
-Jaggie
0
 

Author Comment

by:wgrogers
ID: 20375344
Oh, that's right.  I did that yesterday and nothing changed.  Also tried a system restore but no help.

-Greg
0
 

Expert Comment

by:replylalit
ID: 20375856
Try to get the program/process which is showing you the registration message box.
Get the name of it from task manager and kill the same.

Then go to Services.msc and check if the process is there as a service, if it is make its startup a manual startup which currently would be automatic.

This is harmful and your system is running in a good way, so this should be done.
0
 
LVL 4

Expert Comment

by:superfooz74
ID: 20376098
it might be referring to Office

http://support.microsoft.com/kb/236592
0
 
LVL 4

Expert Comment

by:superfooz74
ID: 20376118
0
 

Author Comment

by:wgrogers
ID: 20376472
replylalit:

I rebooted and got the popup, opened task manager.  Under "Applications" it just shows "Registration Wizard"  Status=Running.  If I switch to "Processes", then drag the pop up around the desktop, I see CPU usage increase for regwiz.exe and explorer.exe.  Should I locate regwiz.exe and delete it?
0
 
LVL 4

Expert Comment

by:superfooz74
ID: 20377007
Even if you delete the process, it will pop up next time you reboot. It seems that for some reason, your copy of XP thinks it is not registered.

I would try to re-register it, instructions here
http://www.helpline4it.com/lab_practices-d497.html

if it gives you a problem you could try calling Microsoft, i think they give you a number to cal lif registration fails
0
 

Author Comment

by:wgrogers
ID: 20378720
MS says if the OS is OEM product to contact mfg.  I contacted Dell and they said it's an OS issue, contact MS.  Catch-22 I guess.
0
 
LVL 22

Expert Comment

by:orangutang
ID: 20379724
Also, send us your HijackThis (http://www.trendsecure.com/portal/en-US/threat_analytics/hijackthis.php) or your Autoruns (http://www.microsoft.com/technet/sysinternals/Utilities/AutoRuns.mspx) log. Paste it with "Attach Code Snippet".
0
 

Author Comment

by:wgrogers
ID: 20380407
Here is HJT log
Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:42:02 PM, on 11/29/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal
 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\wwSecure.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Logitech\iTouch\iTouch.exe

C:\Program Files\QuickTime\qttask.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2K1.EXE

C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2K1.EXE

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\Program Files\Logitech\MouseWare\system\em_exec.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBPA.EXE

C:\Program Files\Skype\Plugin Manager\skypePM.exe

C:\Documents and Settings\Administrator\Desktop\HiJackThis.exe
 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Documents%20and%20Settings/Administrator/Desktop/index.html

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\regwiz.exe,

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe

O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [Firewall auto setup] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winlogon.exe

O4 - HKUS\S-1-5-18\..\RunOnce: [ati] C:\Documents and Settings\LocalService\scvhost.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [ati] C:\Documents and Settings\LocalService\scvhost.exe (User 'Default user')

O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll

O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll

O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe

O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

O16 - DPF: Web-Based Email Tools - http://email.secureserver.net/Download.CAB

O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} (DownloadManager Control) - http://dlmanager.akamaitools.com.edgesuite.net/dlmanager/versions/activex/dlm-activex-2.0.5.0.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1139736399187

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - https://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab

O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab

O16 - DPF: {BA5E57BB-88D5-422A-AC9E-C01A6EEE2537} (WebDvr3 Class) - http://192.168.2.3/WebDvr3.cab

O16 - DPF: {E991BDE0-9816-4094-853E-6BDB60F0342D} (Get_ActiveX Control) - http://apps.corel.com/nos_dl_manager/plugin/IENetOpPlugin.ocx

O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs: ??????????????? C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll

O21 - SSODL: bvkVkFKQCf - {0C77B44C-A6DD-1EE6-7A22-7E584FD1DCF8} - C:\WINDOWS\system32\adgbjl.dll (file missing)

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe

O23 - Service: Washer Security Access (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\System32\wwSecure.exe
 

--

End of file - 6913 bytes

Open in new window

0
Enterprise Mobility and BYOD For Dummies

Like “For Dummies” books, you can read this in whatever order you choose and learn about mobility and BYOD; and how to put a competitive mobile infrastructure in place. Developed for SMBs and large enterprises alike, you will find helpful use cases, planning, and implementation.

 
LVL 22

Expert Comment

by:orangutang
ID: 20380427
This seems like the cause:
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\regwiz.exe,
0
 
LVL 22

Expert Comment

by:orangutang
ID: 20380448
I would also suggest scanning with SUPERAntiSpyware (http://www.superantispyware.com/downloadfile.html?productid=SUPERANTISPYWAREFREE) because you have some spyware.
0
 
LVL 22

Expert Comment

by:orangutang
ID: 20380460
Actually, it doesn't really seems like you have spyware but you should scan just in case and correct this:
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\regwiz.exe,
0
 

Author Comment

by:wgrogers
ID: 20380492
So you are saying run HJT and check F2 then Fix Checked?  
What about 010 - Unknown file in Winsock LSP?
Also, 021 - SSODL adgbjl.dll (file missing)?

Are those safe to delete?

Thanks
0
 

Expert Comment

by:replylalit
ID: 20383184
Try to rename this file,  and check what happens

C:\WINDOWS\system32\regwiz.exe
rename to regwiz_x.exe
0
 

Author Comment

by:wgrogers
ID: 20383424
If I rename it or even change the extension, after I reboot it reappears in the system32 folder.
0
 
LVL 22

Expert Comment

by:orangutang
ID: 20383699
Did you scan with SUPERAntiSpyware? I'm not sure how to fix:
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\regwiz.exe,
Have you tried checking it and fixing it in HijackThis? I think you should be able to remove the entire line.
0
 
LVL 22

Expert Comment

by:orangutang
ID: 20383714
Actually, open regedit to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
and make sure the "Userinit" value is:
C:\WINDOWS\system32\userinit.exe,
I'm not sure why it says "system.ini", though.
0
 

Author Comment

by:wgrogers
ID: 20384733
I have not scanned with SAS.  Scanned with Kaspersky.  Don't want to modify anything unless you're sure what it is and what it will affect.  I'm not all that experienced with the effects of changing and deleting these kinds of things so want to avoid more problems.  I don't understand though why running sfc /scannow with the OS disc didn't change the "registration"?

Anyway, thanks for help.
0
 
LVL 22

Accepted Solution

by:
orangutang earned 500 total points
ID: 20385004
Okay, open regedit to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Right-click the key, click "Export", save the backup with any name you want.
Make sure the "Userinit" value is:
C:\WINDOWS\system32\userinit.exe,
0
 

Author Comment

by:wgrogers
ID: 20385291
Well what do you know?  I changed the registry value and voilà!  No more pop up!!  Best points I've spent in a while.  Thank you for your help.
0

Featured Post

Promote certifications in your email signature

Has your company recently won an award or achieved a certification? They'll no doubt want to show it off. Email signature images used to promote certifications & awards can instantly establish credibility with a recipient and provide you with numerous benefits.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Join Greg Farro and Ethan Banks from Packet Pushers (http://packetpushers.net/podcast/podcasts/pq-show-93-smart-network-monitoring-paessler-sponsored/) and Greg Ross from Paessler (https://www.paessler.com/prtg) for a discussion about smart network …
In this article, I will show you HOW TO: Install VMware Tools for Windows on a VMware Windows virtual machine on a VMware vSphere Hypervisor 6.5 (ESXi 6.5) Host Server, using the VMware Host Client. The virtual machine has Windows Server 2016 instal…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

863 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now