79 replies to this topic

[Ztruker]

One more thing to try: Open a Command Prompt (Start / Run type cmd and press Enter). Enter these one at a time: regsvr32 appwiz.cpl regsvr32 mshtml.dll I think I had you do appwiz.cpl before, but do it again anyway.

[appleoddity]

Rich, please e-mail me the procmon file. The OPs "purple" CD is an original "DELL Labeled" XP installation disc. Probably with service pack 1. It will function normally for a reinstall but will not require a product key be entered. The "Brown" application CD is for reinstalling drivers and software after the reinstall of XP. Just to clear things up. I'm not suggesting that be done. I would like to review this a little further but I want that procmon data sent over as soon as possible, so I figured I would reply immediately.

[ems88]

Yes, I agree, I don't want to do the restore unless it's the last option. I've entered those in command prompt but it's a no go.

[appleoddity]

Hi ems88... Lets try a few things.

First, lets get your Application and System event logs and look for any errors there. Here's how:

How to capture an event log and upload it to the forum:

• First, open Event Viewer by clicking Start -> Run -> type eventvwr.msc and press ENTER.
• In the Event Viewer please right click the requested event log (i.e. Application, system, etc...) and click Save Log File As.
• Please save the logfile to your desktop and give it a recognizable name.
• Do this for each log that has been requested.
• When you are finished saving the necessary logs, close Event Viewer.
• On your desktop find the saved log files. Hold the CTRL key and click to select each event log.
• When all event logs are selected, right-click one of them, click Send to -> Compressed Zip Folder.
• A new .ZIP file will have been created on your desktop. Please attach that file to this forum in your next reply.

Next, lets revert your system to a limited startup mode and see if it is a running process causing the problem.

Click start -> run -> type msconfig and press ENTER. When msconfig opens, click the "sevices" tab, select "Hide all Microsoft services," then click "Disable All." Now, click the the "Startup" tab, click "Disable All." Now, click OK, and restart your computer when prompted. See if add/remove programs works now? After your test, please open msconfig again, click the "general" tab, and select normal startup. Click, OK, and restart your computer when prompted.

If add/remove programs did not work after your last test then lets get a little more aggressive. Every add/remove listing problem I have seen was a result of a problematic listing in the "uninstall" registry key. First of all, we will do some significant registry editing. I am not going to add another warning about backing up your registry because previously you said you did so for ztruker.

So, lets begin. Open regedit. Click start -> run -> type regedit and press ENTER. Navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall. I want you to right-click the "Uninstall" key, and rename it to uninstall.bak. In testing this procedure registry editor hung up for several seconds on my computer while it did this. Don't panic, just wait. Now, leave registry editor open and try to open add/remove programs again. Because the add/remove program applet does not only rely on the uninstall key, you should still see a listing of progams installed on your computer if it is working properly.

Once you test add/remove programs, close it, and rename the registry key back to "Uninstall"

Let me know your results and be sure to attach those system and application logs.

Ems88, please clarify - When you open add/remove programs does it say, "Please wait while the list is being populated...?" Or, is it completely blank? Also, please tell me what anti-virus products you have installed are?

Edited by appleoddity, 26 August 2009 - 08:28 PM.

[ems88]

Hi appleoddity, I have tried what you suggested and the A/R programs didn't appear after I tried them. When I open A/R, it is completely blank. I have Avira Antivir installed.

Attached Files

•  Event_Viewer_system.zip   77.98KB   166 downloads

[appleoddity]

Hello ems88...

Please read here: http://forums.whatth...rs_t106388.html

And, post a new thread here: http://forums.whatth...emoval_f27.html

Judging from the hundreds of warnings generated by Avira up to 8/11/2009 (most likely when it got nuked all together) about files that are infected in significant locations such as windows\system32, your automatic updates services has been nuked, and Avira won't work properly, your computer has been carrying a significant malware infection for many months. Please visit the malware removal forum as posted above. You might mention that I see possible evidence of a new, prevalent root-kit infection that we have seen around here quite a bit in recent weeks. It appears at the same time your Avira quit working (8-11-09). It is not detected by normal means and root-kit "detectors" will not always find it. They'll know what to do over there.

If you continue to experience troubles after your system has been given the all clear, you may come back here and we will pick up this thread where we left off.

EDIT: As found here: http://forums.whatth...ns_t105905.html Your malware removal thread has been re-opened at your request due to a persistent "malicious behavior," detected on your computer. Please follow up in that thread and request further assistance and a more thorough examination of your system. Because it has been several days, you might want to read here to receive further assistance: http://forums.whatth...931#entry406931

It is actually against WhatTheTech policy for techs to assist you with problems while a related malware removal thread is open. Somehow this slipped through the cracks. Once given the all clear you may proceed in this thread if there are still problems. Thanks.

Edited by appleoddity, 26 August 2009 - 10:11 PM.

[ems88]

Thanks appleoddity. I'm looking into the links you've provided.

[ems88]

So my computer has been checked and is now clean http://forums.whatth...i....html&st=30 but A/R is still not working.

Edited by ems88, 31 August 2009 - 06:32 PM.

[Ztruker]

I'm stumped. I don't know why A/R is not working and I can't seem to find anything that makes it work, other than you killing wmipsrv from Task Manager after you start A/R. The problem has to have something to do with WMI (Windows Management Interface) but nothing I've found has made any difference for you. Perhaps it's time to bite the bullet and use your System Recovery CD (the Operating System one) to put your computer back to how it was when you first bought it? If you can live with A/R as it is and are not having any other problems then this may not be the path you want to take. If you are having other problems, then this is probably the quickest way to get everything working again. If you decide to do this, you need to save your personal data first as the recovery process will wipe your hard drive. Let me know what you want to do. If you want to continue to work on this I'll keep searching for other possible fixes. You're call. I'm going to ask for some more ideas in our private tech area forum again. Maybe someone else has an idea I've missed.

[ems88]

There's nothing else wrong with my computer besides A/R not working so I'm hesitant to use the System Recovery CD. If I save my personal data, use the System Reovery CD, what exactly happens after I use it? Will things be the same as before using the CD, only with A/R in place or will there be drastic changes? I really want to fix this without using the CD so you have any other suggestions...

[Ztruker]

If you use the recovery CD, your system will be like the day you purchased it. You would need to reload your personal data, reinstall all applications you installed since then. A drastic step for this one, single problem. I'll post back as soon as I have any ideas.

[Ztruker]

I'd like you to run System File Checker (SFC) and see if that fixes this problem.

Click Start then Run, type sfc /scannow and press Enter

You will be prompted to put your XP CD in the drive, please do so. SFC will run without any feedback and close when done. Remove the CD and reboot then see if A/R Progs works.

Here is a good article by Marc Liron, MSMVP on SFC: http://www.updatexp....cannow-sfc.html

[ems88]

Everytime I put in a CD, it says that it's the wrong one and I've tried all of them.

[Ztruker]

Rats, my fault! I'm sorry. I forgot that you don't have a normal XP install CD, just the system restore CD, so SFC won't work for you.

At this point I'm completely out of ideas, and other than doing a complete recovery of your system back to it's factory installed state, I don't know how to fix this Add/Remove Programs problem.

Fortunately, you have two valid workarounds.

1. Start A/R Progs. Open Task Manager and kill wmiprvse.exe.
2. Use Revo Uninstaller.

I'll continue to look for ideas but for now, I'm stumped. Maybe we'll get lucky and one of the other techs here will come up with an idea. If they do we can pick this up again at that time.

We don't close threads at WTT so this one will always be available to continue working with.

[Tomk]

@Rich, Won't a borrowed CD work for sfc /scannow? @ems88 , Do you have any friends with a XP home CD?