[RESOLVED] Regedit has caused an error in <unknown>

Get your favourite beverage and settle in for a little tale.

Sunday morning I'm up early (6.00am) with my 2 year old and decide to run a thorough scandisk on my system.

After about 2 and a half hours my wife is up and I decide to take a shower.

When I come up she is on the net and tells me that when she tries to check email she gets an error - something about invalid socket - blah blah.

She also tried opening an existing email and gets and error msin (I think) caused an error in msin - blah blah.

I try to reboot and the thing freezes.

After a few attempts to fix problem via scanreg /fix, restoring a previous registry I give up as we are going out.

Later I copy the windows directory to another drive and then restore windows from a ghost image made 2 days earlier.

I labouriously go through and copy across updated mail .dbx files and any documents etc that have been updated.

All is well - or so it seems.

Later that day I go to burn a CD and nada, it does all the prep like it's going to burn but then nothing.

So I uninstall Roxio ECDC 5 Platinum and reinstall it and it's updates.

During one of the updates an error pops up

Quote:

---

Regedit has caused an error in <unknown>
Regedit will now close

---

I click ok and it continues and after the required reboots ECDC is working fine.

Last night I was doing my regular maintenance and went to fire up Regedit so I could manually clean out some of the MRUs

Quote:

---

Regedit has caused an error in <unknown>
Regedit will now close

---

and when I clicked ok

Quote:

---

This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator.

---

What the ????

Anyway I go and find Regedit.exe in C:\Windows and notice it's lost it's icon and is now the generic .exe icon.

Since it was already 2.00am I decided it was probably a good idea to leave it and not start mucking around with backups, extracting from the setup CD etc.

I go to bed.

6.30am and my 2 year old wakes up, but luckily wants to come in to our bed.

7.00am - now he wants to get up.

Whilst I'm getting him some breakfast, emptying the dishwasher etc, I suddenly remember the old lap top I have with WinMe installed.

I get it out and power up, copy Regedit.exe to a USB drive and then copy from that USB drive to my PC.

Try Run > Regedit and it works perfectly. https://discussions.virtualdr.com/im.../2012/05/1.gif

So.....it appears that Regedit.exe got corrupted or something which I guess is possible, but any hints as to why ?

It's Windows Mistake Edition.https://discussions.virtualdr.com/im.../2006/05/1.gif

Quote:

---

Originally Posted by lgbpop

It's Windows Mistake Edition.http://bestsmileys.com/computer1/10.gif

---

Thanks :rolleyes: :D

This sort of problem is usually caused by malware of one kind or another - try changing regedit.exe to regedit.com - and launch that, see if that works.

You may already have a virus/spyware hijack

download the Stinger from here and run it to make sure that A-V-disabling
viruses are not present on your PC
http://us.mcafee.com/virusInfo/default.asp?id=stinger

- update your virus scanner and run a full system scan of all files.

Reboot to Safe Mode and run CWShredder - to remove variants of the CoolWebSearch hijacker.
http://www.merijn.org/cwschronicles.html

Use CWShredder, the removal tool:
http://www.trendmicro.com/cwshredder/

download AdAware SE Personal Edition from www.lavasoftusa.com, install, update, and run it to remove spyware, adware, and other such nasties from your system.

I've run Hijack this, Ad-Aware, SS&D, A-Squared, Avast and nothing has been picked up.

I'll run CWS and Stinger also and let you know.

I think it was just a cruel twist of nature trying to drive me crazy.

CWS nothing.
Stinger nothing.

That was the easy fix :(

(I've seen no result from renaming the .exe to .com file yet??)

OK - now we have to get serious :)......
what's in the MSCONFIG Startup list?

Have you tried using System Restore back to the last time the system worked OK (NOT MORE THAN 10 DAYS AGO, please!!!)

What version of ECDC is involved? - and when was the last time you updated the system from Windows Updates??

renaming the file from .exe to .com resulted in the same error.

MSconfig not much - I'll post back tonight when I'm at home.

System restore is turned off - I use ghost and make an imag every couple of days and will fall back to that if required.

ECDC 5 Platinum all updated I'll post back the exact version later.

Don't use Windows Update.

Nix, Looks like you might have caught the W32.Sober.C@mm worm. It affects the registry among other things. Look here for info (Where it burrows into) and removal procedure.

http://[email protected]

Hope this helps abit.

No checked all that out - fine.

As i said in the first post the replacement copy of REGEDIT.EXE works fine.

Also tonight I hear my wife telling my son she can't copy in word.

I check it out and any time you right click in a word document you get

Code:

---

Winword has caused an error in Winword

---

and when you click ok it closes down.

Much searching and deleting of NORMAL.DOT didn't help so I ended up uninstalling and resinstalling it - which fixed the problem.

So I'm thinking that what ever happened when my wife started getting the errors in MSIMN caused minor corruption of some files / the registry - maybe because the thorough scan disk was still running.

Well something got corrupted for sure. Glad you're squared away. :)

With SR disabled and Windows updates not installed, you really are F&^*ed!

what's the point of running an OS that tries to help if you disable all the helpers??

There is NOTHING that should should cause that winword error, AFAIK, except a corrupted NORMAL.DOT - did you do a Search for files, and renme/delete ALL such found??

To me it sounds like the typical issues Ive had with many systems installed on a FAT32 formatted Drive..
In this case you may have a suspect sector or 20 on the hdd, the cause of the original corruption and prob.. when you restored your drive image, the correct data was written over the sick sectors..
One tool I use to check/confirm this issue is HDD Regenerator. saved my tail many times in several operating systems..

Quote:

---

Originally Posted by NoelMVP

With SR disabled and Windows updates not installed, you really are F&^*ed!

what's the point of running an OS that tries to help if you disable all the helpers??

There is NOTHING that should should cause that winword error, AFAIK, except a corrupted NORMAL.DOT - did you do a Search for files, and rename/delete ALL such found??

---

In reverse order yes I deleted normal.dot and $normal.dot numerous times with reboots in between and the problem persisted so I uninstalled word and reinstalled an it fixed it.

Helpers - I like to be in control of my system. I'd rather restore from a ghost image than use system restore.

And as far as windows updates well...

There's a thread somewhere on VDr that I spoke quite a bit about my reasons for not using SR and WU.

I'll try and dig it up.

Quote:

---

Originally Posted by Undertaker02

To me it sounds like the typical issues Ive had with many systems installed on a FAT32 formatted Drive..
In this case you may have a suspect sector or 20 on the hdd, the cause of the original corruption and prob.. when you restored your drive image, the correct data was written over the sick sectors..
One tool I use to check/confirm this issue is HDD Regenerator. saved my tail many times in several operating systems..

---

Hmm sounds credible especially as I had this problem earlier in the week http://discussions.virtualdr.com/sho...d.php?t=206303

Quote:

---

Originally Posted by Nix

I'll try and dig it up.

---

Here it is http://discussions.virtualdr.com/sho...d.php?t=181877

Ok So over the weekend Firefox stopped working.

It upgraded itself to 1.5.04 and was all working fine, the next day it wouldn't start up so I had to reinstall.

Then later Spybot was getting Spybot caused and error in unknown and I had to reinstall it.

Then later a game that had been working fine for months wouldn't start for my son and I had to reinstall it.

It's almost like parts of the registry are getting wiped or exe files getting corrupt.

Ran thorough scandisk on all hd partitions with no issue.

Ran Ad-Aware, Spybot, Avast and A-Squared, Hijack This and none of them found a thing.

Decided to look at System Information and it just sits there with a timer whilst loading Help and Support and if you click close it comes up with a message saying

Quote:

---

Application is busy. Do you want to abort.

---

and if you say yes it just closes it down.

Something screwy going on somewhere.

See what Pestpatrol finds.
http://www3.ca.com/securityadvisor/pestscan/
It will not fix anything, but does have a log you can save.

Spysweeper, another of the same type. No log though.
http://www.webroot.com/services/spyaudit_03.htm

They do a good job of finding what you have miss.
HTH

Quote:

---

Originally Posted by Train

See what Pestpatrol finds.
http://www3.ca.com/securityadvisor/pestscan/
It will not fix anything, but does have a log you can save.

Spysweeper, another of the same type. No log though.
http://www.webroot.com/services/spyaudit_03.htm

They do a good job of finding what you have miss.
HTH

---

Neither found a thing.

Also for future reference and anyone reading this thread, Pestpatrol needs to be run in IE5 or above.

One thing that did concern me was that at one stage it said it was scanning C:\Documents & Settings which is a directory that does not exist in WinMe ?

Good news then.
As for the C:\Documents & Settings ., it does the same thing in 98. LOL

Forgot to mention that prior to running those two my wife tried to open a .mov file and got
Play.exe has caused an error in <unknwown> Play.exe will now close.

I resinstalled Quicktime for windows 2.1.2 and it resolved the issue although subsequently to that I started up QT5 and reassociated it's files and the same .mov now opens in QT5.

So I'm still going with my theory that somehow part of the registry got corrupted and one by one programs will pop up with the error in <unknown> only to be fixed by a reinstall of the affected program.

The Parite Virus causes .exe files to stop working, and most AVs can't erase it. The only that I have seen that can erase it is Nod32.
Luckily, there is a neat little tool called Sav32Cli from Sophos which does a terrific job of cleaning it up. The instructions for using it on ME are here.

On another note, when do you think you are gonna upgrade to XP? ;)

Quote:

---

Originally Posted by usil

On another note, when do you think you are gonna upgrade to XP? ;)

---

He is waiting to see which dies first!

Him or the computer!

He will if he does not get rid of that antique and OS. ;)

Quote:

---

Originally Posted by Train

He is waiting to see which dies first!

Him or the computer!

He will if he does not get rid of that antique and OS. ;)

---

LOL the PC's only 5.5 years old although I think it's the freezing when first booting in the morning that could be causing the issues so.............a new system could be required, then I could quadroople boot Win98SE, WinME, Win2000 and WInXP ????

5.5 in computer years is about 90 in human years. Its still alive but pushing its luck. :D

Did you try the Sav32Cli virus removal tool?

Yes tried Sav32Cli and nothing.

Yesterday morning Firefox was not working and a SWF movie for a game was freezing.

Both had been working fine the night before.

The only thing I did in between was:

Defrag all drives
Shutdown.

So that implies to me that soemthing is happening during one of the processes that is corrupting files - probably the most recently used ?

Since defrag moves things around on the disk, it leads me to think that it's it - which is a real worry.

Maybe it got corrupted somehow and is perpetuating the problem ?

I'll referain from defragging for a while to see how I go.

Got a 98SE bootdisk?
If you do, boot it up and scandisk the darn thing.
What I would try.

You can also go Start, Run[type in] scandisk.ini
and hit enter.
scroll down to this line:

NumPasses = 1 ; 1 through 65,535 (anything over 10 is slow)
change it to this:
NumPasses = 5 ; 1 through 65,535 (anything over 10 is slow)

Go to File and select Save.
Scandisk.
I have had to use 10 a bunch of times. But it worked, but like they say it takes time. And I do not let it fix anything with out my OKing it. Just about anything that is messed up I delete. Just me there.

Is the Win98SE scandisk better than the WinMe one ?

I have Win98SE installed on one partition and boot to it through XOSL of boot to DOS prompt and run it from there.

Also have the Win98SE boot disk anyway.

I did run thorough scandisk in WinMe but presumably on the default setting in scandisk.ini

Have you checked your memory with Memtest? I have seen a similar problem with .exe files and the memory was bad. I am not sure that the memory caused those errors, but its possible.

I did run it for a few hours with no issue, maybe I didn't run it long enough.

It would be best to run it overnight. Sometimes, the errors show up after a long time of running it.

Arrrgrhgrhrgrhrhrghr.

Booted to Win98SE DOS prompt ran scandisk with the change Train suggested on the drives that have shown the 'weird' corruption syptoms and all passed.

Booted WinMe and went fire up Everest to see HD temps and got Everest has caused an error in everest.bin blah blah.

Went to start up Firefox and it wouldn't start, like it was not installed.

Ran scandisk and went to open the log and it tried to open it in Wordpad - previously .log files were associated with notepad - but got Wordpad has caused an error in unknown

So this now makes me think that it's memory as suggested or the Ultra ATA controller or the mobo finally giving up the ghost.

I'm about 50% of the way to convincing my wife that we need to buy a new PC so........will run a memory checker overnight in the mean time.

That sounds like it dropping things and not putting them on the hdd.
Run the hdd diagnostic test also.
Your right, the mobo controllers can act up the same way.

Ran Memtest for 12 hours lastnight and it didn't pick up a thing.

Could try for longer but I'm inclined to think it's not a memory issue.

Last lot of 'corruption' occurred after running thorough scandisk - ie reading and rewriting to disk.

Previous lot of 'corruption; occurred after running defrag - ie reading and rewriting to disk.

I'm now trying to think if all the 'corruptions' that have occured and even though they are on different logical drives (partitions) I believe they are all on the same physical drive.

So testing the drive will be next including making sure it's all connected properly.