Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

System 32 folder opens


  • Please log in to reply
14 replies to this topic

#1 borlou11

borlou11

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, Quebec, Canada
  • Local time:12:30 AM

Posted 20 January 2014 - 12:23 PM

Hi,

Probably a minor problem for you. Each time I restart Windows XP a screen comes up with "system 32" file. My PC works ok but this just bothers me.

Any suggestion ?

Thank you !

Borlou


Edited by hamluis, 21 January 2014 - 10:49 AM.
Edited title for accuracy - Hamluis.


BC AdBot (Login to Remove)

 


#2 JohnC_21

JohnC_21

  • Members
  • 24,437 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:30 AM

Posted 20 January 2014 - 12:55 PM

Can you post a screen shot? This may be malware related.


Edited by JohnC_21, 20 January 2014 - 12:55 PM.


#3 borlou11

borlou11
  • Topic Starter

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, Quebec, Canada
  • Local time:12:30 AM

Posted 20 January 2014 - 01:15 PM

Hi,

I am not very familiar with printscreen. So I hope this will be ok.

Attached Files



#4 JohnC_21

JohnC_21

  • Members
  • 24,437 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:30 AM

Posted 20 January 2014 - 02:19 PM

I was thinking it was a System 32 "file" but this is the system 32 folder. It can happen if there is a problem with the registry due to corruption or malware. Download Malwarebytes, update the database and run a quick scan. If it finds something post the log here but do not clean anything. Start a new thread in the Am I infected Forum referencing this thread. If it does not find anything, there are a couple of registry keys that needs to be looked at.



#5 borlou11

borlou11
  • Topic Starter

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, Quebec, Canada
  • Local time:12:30 AM

Posted 20 January 2014 - 06:11 PM

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2014.01.20.08

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Owner :: BORIS-9E7B25E3D [administrator]

20/01/2014 4:13:31 PM
mbam-log-2014-01-20 (16-13-31).txt

Scan type: Full scan (C:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 387551
Time elapsed: 1 hour(s), 36 minute(s), 18 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)



#6 JohnC_21

JohnC_21

  • Members
  • 24,437 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:30 AM

Posted 20 January 2014 - 08:42 PM

In an admin account select Start>Run and type msconfig in the box. Under the startup tab, please post a screenshot. You may have to do more than one to get all the startup items.

 

Edit: With the Msconfig window active press Alt+ PrtScrn. You can paste it into Paint and save it.


Edited by JohnC_21, 20 January 2014 - 08:47 PM.


#7 borlou11

borlou11
  • Topic Starter

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, Quebec, Canada
  • Local time:12:30 AM

Posted 20 January 2014 - 10:32 PM

Please find attached printscreens of Startup as requested. Hope they are readable !

Attached Files



#8 joseibarra

joseibarra

  • Members
  • 1,259 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Downstairs
  • Local time:01:30 AM

Posted 21 January 2014 - 08:13 AM

Microsoft knows why and tells you here:

 

http://support.microsoft.com/kb/170086/en-us

Here is what Microsoft does not tell you in that article (one way to backup your registry):

Before making registry changes, backup your registry with this popular free and easy to use tool:

http://www.snapfiles.com/get/erunt.html

The reason your system got this way in the first place is usually due to some malicious software infections.  It could be a current malicious software infection or residue from one that was partially removed by your current tools leaving behind bogus startup entries in your configuration.  You must finish the cleanup yourself.
 


Edited by joseibarra, 21 January 2014 - 08:14 AM.

The mediocre teacher tells. The good teacher explains. The superior teacher demonstrates.


#9 JohnC_21

JohnC_21

  • Members
  • 24,437 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:30 AM

Posted 21 January 2014 - 08:48 AM

On the second picture there is a blank entry after LVComSX. Uncheck that and press Apply. Reboot. Does it solve the issue?

#10 borlou11

borlou11
  • Topic Starter

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, Quebec, Canada
  • Local time:12:30 AM

Posted 21 January 2014 - 08:59 PM

Attached File  Hkey local machine-software-Microsoft-Windows-CurrentVersion-run-p.JPG   114.91KB   0 downloads

 

Attached File  Hkey current user-software-Microsoft-Windows-CurrentVersion-run-p.JPG   71KB   0 downloadsJoseibarra,

 

I read the Microsoft article http://support.microsoft.com/kb/170086/en-us you mentionned. Made a backup of the registry. Then, I went into the Registry Editor and tried to make sense between the "Resolution" in this article and my registries. Not being very knowledgeable with the Registry, I did not recognise anything "incorrect, incomplete, or null entries (such as "")".

Please find enclosed printscreens of the registries mentionned, maybe you will see something that should not be there.There is a registry under "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AutorunsDisabled"

that I am unable to post the printscreen because the file is too big to upload on this post. If you need it, I can send it by another post.

When you mentioned "You must finish the cleanup yourself.", did you mean through the Registry Editor or other means ?


 



#11 borlou11

borlou11
  • Topic Starter

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, Quebec, Canada
  • Local time:12:30 AM

Posted 21 January 2014 - 09:21 PM

JohnC_21

I did as you instructed about the"blank entry after LVComSX". It did not solve the issue and I received the following message:

 

"System Configuration Utility

You have used the System Configuration Utility to make changes to the way Windows starts.

The System Configuration Utility is currently in Diagnostic or Selective Startup mode, causing

this message to be displayed and the utility to run every time Windows starts

Choose the Normal Startup mode on the General Tab to start Windows normally and undo the

changes you made using the System Configuration Utility."

 

I checked and System Configuration Utility was in Normal Startup mode but the "blank entry after LVComSX" had disapeared. So I did a System Restore.

 

 



#12 borlou11

borlou11
  • Topic Starter

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, Quebec, Canada
  • Local time:12:30 AM

Posted 24 January 2014 - 10:33 AM

Do you have any other suggestions ?



#13 JohnC_21

JohnC_21

  • Members
  • 24,437 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:30 AM

Posted 24 January 2014 - 11:05 AM

Sorry, I lost track of this thread. I could not see anything in the HKLM Run registry keys except the LGODDFU key which relates to automatic firmware upgrade to the optical drive. You could delete that key after you make a backup of it and see if solves the issue. Click on the LGODDFU key (not Run), right click and select delete. This needs to be done in an admin account.

 

To backup the Run key, right click it and select export.

 

Edit: If the above does not solve the issue. Run msconfig again and uncheck the following.

 

igfxtray

igfxpers

 

Reboot:

 

Edit: I would follow joseibarra's advise and install Erunt first. It is a very good registry backup uitility and allows recovery of the registry even if the computer does not boot. I would also let it install using the default setting of automatically creating a backup.


Edited by JohnC_21, 24 January 2014 - 11:39 AM.


#14 borlou11

borlou11
  • Topic Starter

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, Quebec, Canada
  • Local time:12:30 AM

Posted 29 January 2014 - 03:54 PM

Sorry, was sick.

Deleted the LGODDFU key and the system32 folder doesn't come up. And as suggested, installed ERUNT.

Thank you for the help and sorry for the delay.



#15 JohnC_21

JohnC_21

  • Members
  • 24,437 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:30 AM

Posted 29 January 2014 - 04:00 PM

Thank you for the update on the issue. Hope you are feeling better now.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users