[RESOLVED] Regedit has caused an error in <unknown>

[Nix]

Get your favourite beverage and settle in for a little tale.

Sunday morning I'm up early (6.00am) with my 2 year old and decide to run a thorough scandisk on my system.

After about 2 and a half hours my wife is up and I decide to take a shower.

When I come up she is on the net and tells me that when she tries to check email she gets an error - something about invalid socket - blah blah.

She also tried opening an existing email and gets and error msin (I think) caused an error in msin - blah blah.

I try to reboot and the thing freezes.

After a few attempts to fix problem via scanreg /fix, restoring a previous registry I give up as we are going out.

Later I copy the windows directory to another drive and then restore windows from a ghost image made 2 days earlier.

I labouriously go through and copy across updated mail .dbx files and any documents etc that have been updated.

All is well - or so it seems.

Later that day I go to burn a CD and nada, it does all the prep like it's going to burn but then nothing.

So I uninstall Roxio ECDC 5 Platinum and reinstall it and it's updates.

During one of the updates an error pops up

Regedit has caused an error in <unknown>
Regedit will now close

I click ok and it continues and after the required reboots ECDC is working fine.

Last night I was doing my regular maintenance and went to fire up Regedit so I could manually clean out some of the MRUs

Regedit has caused an error in <unknown>
Regedit will now close

and when I clicked ok

This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator.

What the ????

Anyway I go and find Regedit.exe in C:\Windows and notice it's lost it's icon and is now the generic .exe icon.

Since it was already 2.00am I decided it was probably a good idea to leave it and not start mucking around with backups, extracting from the setup CD etc.

I go to bed.

6.30am and my 2 year old wakes up, but luckily wants to come in to our bed.

7.00am - now he wants to get up.

Whilst I'm getting him some breakfast, emptying the dishwasher etc, I suddenly remember the old lap top I have with WinMe installed.

I get it out and power up, copy Regedit.exe to a USB drive and then copy from that USB drive to my PC.

Try Run > Regedit and it works perfectly.

So.....it appears that Regedit.exe got corrupted or something which I guess is possible, but any hints as to why ?

[lgbpop]

It's Windows Mistake Edition.

[Nix]

It's Windows Mistake Edition.

Thanks

[NoelMVP]

This sort of problem is usually caused by malware of one kind or another - try changing regedit.exe to regedit.com - and launch that, see if that works.

You may already have a virus/spyware hijack

download the Stinger from here and run it to make sure that A-V-disabling
viruses are not present on your PC
http://us.mcafee.com/virusInfo/default.asp?id=stinger

- update your virus scanner and run a full system scan of all files.

Reboot to Safe Mode and run CWShredder - to remove variants of the CoolWebSearch hijacker.
http://www.merijn.org/cwschronicles.html

Use CWShredder, the removal tool:
http://www.trendmicro.com/cwshredder/

download AdAware SE Personal Edition from www.lavasoftusa.com, install, update, and run it to remove spyware, adware, and other such nasties from your system.

[Nix]

I've run Hijack this, Ad-Aware, SS&D, A-Squared, Avast and nothing has been picked up.

I'll run CWS and Stinger also and let you know.

I think it was just a cruel twist of nature trying to drive me crazy.

[Nix]

CWS nothing.
Stinger nothing.

[NoelMVP]

That was the easy fix

(I've seen no result from renaming the .exe to .com file yet??)

OK - now we have to get serious ......
what's in the MSCONFIG Startup list?

Have you tried using System Restore back to the last time the system worked OK (NOT MORE THAN 10 DAYS AGO, please!!!)

What version of ECDC is involved? - and when was the last time you updated the system from Windows Updates??

[Nix]

renaming the file from .exe to .com resulted in the same error.

MSconfig not much - I'll post back tonight when I'm at home.

System restore is turned off - I use ghost and make an imag every couple of days and will fall back to that if required.

ECDC 5 Platinum all updated I'll post back the exact version later.

Don't use Windows Update.

[greengoose1]

Nix, Looks like you might have caught the W32.Sober.C@mm worm. It affects the registry among other things. Look here for info (Where it burrows into) and removal procedure.

http://[email protected]

Hope this helps abit.

[Nix]

No checked all that out - fine.

As i said in the first post the replacement copy of REGEDIT.EXE works fine.

Also tonight I hear my wife telling my son she can't copy in word.

I check it out and any time you right click in a word document you get

Winword has caused an error in Winword

and when you click ok it closes down.

Much searching and deleting of NORMAL.DOT didn't help so I ended up uninstalling and resinstalling it - which fixed the problem.

So I'm thinking that what ever happened when my wife started getting the errors in MSIMN caused minor corruption of some files / the registry - maybe because the thorough scan disk was still running.

[greengoose1]

Well something got corrupted for sure. Glad you're squared away.

[NoelMVP]

With SR disabled and Windows updates not installed, you really are F&^*ed!

what's the point of running an OS that tries to help if you disable all the helpers??

There is NOTHING that should should cause that winword error, AFAIK, except a corrupted NORMAL.DOT - did you do a Search for files, and renme/delete ALL such found??

[Undertaker02]

To me it sounds like the typical issues Ive had with many systems installed on a FAT32 formatted Drive..
In this case you may have a suspect sector or 20 on the hdd, the cause of the original corruption and prob.. when you restored your drive image, the correct data was written over the sick sectors..
One tool I use to check/confirm this issue is HDD Regenerator. saved my tail many times in several operating systems..

[Nix]

With SR disabled and Windows updates not installed, you really are F&^*ed!

what's the point of running an OS that tries to help if you disable all the helpers??

There is NOTHING that should should cause that winword error, AFAIK, except a corrupted NORMAL.DOT - did you do a Search for files, and rename/delete ALL such found??

In reverse order yes I deleted normal.dot and $normal.dot numerous times with reboots in between and the problem persisted so I uninstalled word and reinstalled an it fixed it.

Helpers - I like to be in control of my system. I'd rather restore from a ghost image than use system restore.

And as far as windows updates well...

There's a thread somewhere on VDr that I spoke quite a bit about my reasons for not using SR and WU.

I'll try and dig it up.

[Nix]

To me it sounds like the typical issues Ive had with many systems installed on a FAT32 formatted Drive..
In this case you may have a suspect sector or 20 on the hdd, the cause of the original corruption and prob.. when you restored your drive image, the correct data was written over the sick sectors..
One tool I use to check/confirm this issue is HDD Regenerator. saved my tail many times in several operating systems..

Hmm sounds credible especially as I had this problem earlier in the week http://discussions.virtualdr.com/sho...d.php?t=206303