any Registry Experts in here please.

[Guest sb55mv]

Hello All,I'm looking for some help here please.do any of you know of any free forums to join to see if I can get some help removing / modifying a reg entry that has been altered by something, but not me.the problem I'm having is when starting XP Pro, it now takes a little longer than before, and yet everything runs,or seems to run OK, but on the start up screen I get a sound and a message that says ''windows could not find monitor.exe,make sure you typed the name correctly and try again'' I only have the option of clicking on the OK button, then it's business as usual.I have NIS2004 with NAV2004 built into it, I have followed the instructions at the symantec web site for the my little spy thing,but there doesn't seem to be anything like it in the reg, and my virus definitions are up to date,I even shut down and re-started in safe mode and ran a full scan, and tried the symantec Live security check, all came back as OK, but obviously it's not.any help here guy's would be most welcome as I'm starting to pull my hair out.thank you to anyone that might be able to help.Steve.

[wsieffert]

From experience with Norton products, it could be Norton causing the slowdown.I repair a neighbor's computer where Norton took over her compter totally. It kept adding files to her hardrive until it got filled.Sometimes Norton gets lost or out of hand. Other virus/spyware products may also go crazy from time to time.W. Sieffert

[Guest SoarPics]

Hi Steve,Have you run a scan using HijackThis (Google)? If you've not worked with this little gem, simply run a scan and post the log here. Be careful about deleting anything (Registry entries) if you're not sure about it.Greg

[Guest sb55mv]

Hi Greg,well, I got that little program you said to get,and it looks very impressive,even if it does mean nothing to me from a tech point of view, this might as well be in russian for all the sence I can make of it. I wil post the log file below here,as something looks suspicious to me about that entry for the monitor.exe thingie that I have marked with asterisks, but I can't find them in the registry anywhere at all..thanks for you're time and help on this.Steve.Logfile of HijackThis v1.97.7Scan saved at 18:54:16, on 27/08/2004Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:WINDOWSSystem32smss.exeC:WINDOWSsystem32winlogon.exeC:WINDOWSsystem32services.exeC:WINDOWSsystem32lsass.exeC:WINDOWSSystem32Ati2evxx.exeC:WINDOWSsystem32svchost.exeC:WINDOWSSystem32svchost.exeC:Program FilesCommon FilesSymantec SharedccSetMgr.exeC:Program FilesCommon FilesSymantec SharedccEvtMgr.exeC:WINDOWSsystem32spoolsv.exeC:Program FilesCommon FilesSymantec SharedccProxy.exeC:Program FilesExecutive SoftwareDiskeeperDkService.exeC:Program FilesNorton Internet SecurityNorton AntiVirusnavapsvc.exeC:Program FilesCommon FilesSymantec SharedSNDSrvc.exeC:Program FilesCommon FilesSymantec SharedCCPD-LCsymlcsvc.exeC:WINDOWSsystem32Ati2evxx.exeC:WINDOWSExplorer.exeC:Program FilesCommon FilesSymantec SharedccApp.exeC:WINDOWSSystem32GSICON.EXEC:Program FilesSaitekSoftwareProfiler.exeC:Program FilesSaitekSoftwareSaiSmart.exeC:WINDOWSSystem32dslagent.exeC:Program FilesNorton Internet SecurityNorton AntiVirusSAVScan.exeC:Program FilesInternet Exploreriexplore.exeC:TEF1HijackThis.exeC:WINDOWSSystem32svchost.exeR0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.google.co.ukR1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://www.google.co.ukR0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Local Page = http://www.google.co.ukF0 - system.ini: Shell=Explorer.exe monitor.exeF2 - REG:system.ini: Shell=Explorer.exe monitor.exeO2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesAdobeAcrobat 6.0ReaderActiveXAcroIEHelper.dllO2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:Program FilesCommon FilesSymantec SharedAdBlockingNISShExt.dllO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:Program FilesNorton Internet SecurityNorton AntiVirusNavShExt.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:WINDOWSSystem32msdxm.ocxO3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:Program FilesCommon FilesSymantec SharedAdBlockingNISShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:Program FilesNorton Internet SecurityNorton AntiVirusNavShExt.dllO4 - HKLM..Run: [ccApp] "C:Program FilesCommon FilesSymantec SharedccApp.exe"O4 - HKLM..Run: [GSICONEXE] GSICON.EXEO4 - HKLM..Run: [soundFusion] RunDll32 hercplgs.cpl,BootEntryPointO4 - HKLM..Run: [Profiler] C:Program FilesSaitekSoftwareProfiler.exeO4 - HKLM..Run: [saiSmart] C:Program FilesSaitekSoftwareSaiSmart.exeO4 - HKLM..Run: [KernelFaultCheck] %systemroot%system32dumprep 0 -kO4 - HKLM..Run: [DSLAGENTEXE] dslagent.exe USBO4 - HKLM..Run: [sSC_UserPrompt] C:Program FilesCommon FilesSymantec SharedSecurity CenterUsrPrmpt.exeO4 - HKLM..RunServices: [Microsoft IT Update] msupdate.exeO4 - HKCU..Run: [symantec NetDriver Monitor] C:PROGRA~1SYMNET~1SNDMon.exeO9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)O9 - Extra button: ieSpell (HKLM)O9 - Extra 'Tools' menuitem: ieSpell (HKLM)O9 - Extra 'Tools' menuitem: ieSpell Options (HKLM)O9 - Extra button: ImTranslator (HKCU)O9 - Extra 'Tools' menuitem: ImTranslator (HKCU)O15 - Trusted Zone: http://www.alphasim.co.ukO15 - Trusted Zone: http://www.alphasim2.comO15 - Trusted Zone: http://forums.avsim.netO15 - Trusted Zone: http://www.flightsim.comO15 - Trusted Zone: http://www.flightsimnetwork.comO15 - Trusted Zone: http://by9fd.bay9.hotmail.msn.comO15 - Trusted Zone: http://www.pentagon-daewoo.co.ukO15 - Trusted Zone: http://www.simviation.comO15 - Trusted Zone: http://security.symantec.comO16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC...bin/AvSniff.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1093546772781O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cabO16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/ac...ta/SymAData.cabO16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa...ash/swflash.cabO16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/ac.../ActiveData.cabO17 - HKLMSystemCCSServicesTcpip..{304269D4-681D-477F-8B9D-5AD17F68355B}: NameServer = 194.74.65.87 194.72.9.39O17 - HKLMSystemCS1ServicesTcpip..{304269D4-681D-477F-8B9D-5AD17F68355B}: NameServer = 194.74.65.87 194.72.9.39

[Guest SoarPics]

We're getting there, Steve. We'll try this the easy way first.Click Start>Run> type "msconfig"> click on the "SYSTEM.INI" tab. If you see monitor.exe listed there disable it and reboot. Hopefully your nagging little message will be gone. If not, we'll next have to get into the registry.Greg

[Guest sb55mv]

Hi Greg.sorry matey,I had a look there allready, tell you what I'm going to do though,and thats make a back up of my reg ready, so that we may mess to our hearts content and not have to worry,I was suspicious that this was a little something that snook into the reg, but I just don't know how,or it might even just be a simple file screw up or whatever(just who am I trying to convince here)well, you know the beauty of modern technology.thanks again greg,registry here we come..... LoLthanksSteve.

[Guest SoarPics]

Hee, hee... now it gets fun, Steve.HijackThis is clearly showing that the .exe is being called by the system.ini. First, let's do a system search for system.ini. It should show you two files... the .ini and a backup. Open both in Notepad and take a look for a call for monitor.exe. If you see it there (in either or both files) delete the line that calls monitor.exe. Delete only the line that calls the monitor.exe.If no luck, it's time to get into the Registry. Navigate to HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun and check there for a registry entry calling the monitor.exe. Also, check the next enrty down, RunOnce, for a call for the monitor.exe.GregP.S. I just did a search of my registry and found only 1 instance of monitor.exe. See the attached screenie for the registry key. I also note that system.ini is called in the same registry key.http://forums.avsim.net/user_files/89405.jpgEdit: I just did a system search for "monitor.exe". I ain't got one! See my sig for sys info. If you have one of those little buggers in your system, you might want to archive it to an off system media and see what happens.

[Guest sb55mv]

Hi Greg.I did what you said, there was no ''monitor.exe'' in the system .ini, just what you said was there, but not that.I started to look in the registry in the place you said, but there was no mention of it there either, but just out of curiosity Greg, I do not have a next entry down called ''run once'', just the one called Run, the next one down after that is settings.thanks again Greg, I feel that we are indeed getting into this now,and I am learning all the time about this reg business,and I also feel that we are starting to track this little bugger down, it's days are coming to an abrupt end, one way or another, it had better be afraid....very...very...afraid....lolSteve.

[Guest SoarPics]

Can you find out what this is from your HijackThis log:C:PROGRA~1SYMNET~1SNDMon.exeIf you don't know what SNDMon.exe is navigate to it and check it's properties. Post info here.Thanks,Greg

[Guest sb55mv]

Hi Gregthat SNDMon thing is a symantec genuine file.I will post a couple of screenies for you.Steve.PS where abouts are you anyway, just curious.(well, alright, nosey then)PPS, the lower is a screen shot of the actual message I get at start up.I'm really confused Greg as to what this is. and I don't know how it got in here in the first place past all the precautions that I have in place, I would like to meet some of these people to show them in a physical way just how much I despise what they do to other peoples machines by their outright selfishness....sorry, rant over now.

[Guest SoarPics]

Ahhh, now that I've seen your error message I went to a commnad line and typed "monitor.exe". I got the same exact message. Makes sense... there is no monitor.exe to start.So you must have something in your start-up that is calling for this .exe. I suspect wsieffert is correct (as he usually is), that Norton has run amuck.You first should try going back into msconfig and clicking on the Startup tab. You might get lucky and find evidence of the nasty .exe call there.Failing that, do a system search for "Start" and continue your journey there. It's probably something in one of your start-up folders. Look for something that wants to start monitor.exe at start-up. And I'll not be surprised at all if, when you find the offending .exe call, that Norton will be involved.GregP.S. I'm in the Peoples Rupublic of California. Where we elect actors with no politcal experience to be governor. And where the politcians mortgage away our children's futures just to pay the state's energy bills (to robber barons). Smog is thick enough to walk on, and traffic is beyond deadly scary. Oh, and we have some really cool palm trees (though why they stay is anybody's guess). :-)

[Guest sb55mv]

Hi again,and thank's Greg.Iwill check those suggestions out and report back as soon as I find out anything.glad you're a ''Governator'' Fan (*;*)Steve.PS did you see my other posts in the other forum about my Water Cooling experiment.

[Guest sb55mv]

Greg.I had no luck with any of the things you said to try in the last reply from you. however, I did find this in ''my documents'', but no trace anywhere else.I will post a pic of it.and I also went into the ms config, nothing there either, but whilst I was in there I decided to try a selective / diagnostic start-up, by disabling everything in there.but, when I re-booted I got the same thing yet again, so I'm totaly confused now.Steve, I have noticed some slight hair loss over the last few days... (*;*)

[Guest SoarPics]

You're attachment isn't working, Steve. Please try again.Greg

[Guest sb55mv]

try this one Greg.Steve.http://forums.avsim.net/user_files/89578.jpg