"Cannot find start"..?!?

Jack the Bear <jack DeleteThis @total.net> wrote in message
news:c34ea0$sg8$1@news.eusc.inter.net...
>
> "Stellijer" <howapropos DeleteThis @hotmail.nospam.com> wrote in message
> news:dBg5c.70671$JN2.54129@bignews4.bellsouth.net...
> > If there a virus which causes an error of "Windows cannot find start" then
> > "...is needed to launch files of type application".
> >
> > I know I had a virus in this computer called "MSUpdate.exe". I got rid of
> that
> > now this "cannot find start" error is happening.
> >
> > Most applications won't launch because windows is looking for this
> undefined
> > phantom file.
> >
> > Any ideas what could have caused this? Was it a registry hammer? What
> can I do
> > to fix the system without reinstalling windows?
> >
>
> Check the Registry in
>
> HKEY_CLASSES_ROOT\exefile\shell\open\command
>
> The data should look like:
>
> (Default) ""%1" %*"
>
> It doesn't in your case.
>
> Any difficulties, feel free to write:
> jack DeleteThis @total.net
>
> Put "ACV" somewhere on the subject of the mail, and it will not get lost in
> the spam.
>
> - Jack the Bear.


Hi and thanks.

Two questions:

1. Does this sound like it was done by a virus or software updating (I updated
NAV and removed a couple viruses just before this happened)

2. Any ideas how to open the registry? Whenever I try to open an application I
get that error. Hence I can't use regedit.
 >> Stay informed about: "Cannot find start"..?!? 

Big Will wrote:

> Stellijer wrote:
>
>> Jack the Bear <jack RemoveThis @total.net> wrote in message
>> news:c34ea0$sg8$1@news.eusc.inter.net...
>>
>>> "Stellijer" <howapropos RemoveThis @hotmail.nospam.com> wrote in message
>>> news:dBg5c.70671$JN2.54129@bignews4.bellsouth.net...
>>>
>>>> If there a virus which causes an error of "Windows cannot find
>>>> start" then
>>>> "...is needed to launch files of type application".
>>>>
>>>> I know I had a virus in this computer called "MSUpdate.exe". I got
>>>> rid of
>>>
>>>
>>> that
>>>
>>>> now this "cannot find start" error is happening.
>>>>
>>>> Most applications won't launch because windows is looking for this
>>>
>>>
>>> undefined
>>>
>>>> phantom file.
>>>>
>>>> Any ideas what could have caused this? Was it a registry hammer? What
>>>
>>>
>>> can I do
>>>
>>>> to fix the system without reinstalling windows?
>>>>
>>>
>>> Check the Registry in
>>>
>>> HKEY_CLASSES_ROOT\exefile\shell\open\command
>>>
>>> The data should look like:
>>>
>>> (Default) ""%1" %*"
>>>
>>> It doesn't in your case.
>>>
>>> Any difficulties, feel free to write:
>>> jack RemoveThis @total.net
>>>
>>> Put "ACV" somewhere on the subject of the mail, and it will not get
>>> lost in
>>> the spam.
>>>
>>> - Jack the Bear.
>>
>>
>>
>>
>> Hi and thanks.
>>
>> Two questions:
>>
>> 1. Does this sound like it was done by a virus or software updating
>> (I updated
>> NAV and removed a couple viruses just before this happened)
>>
>> 2. Any ideas how to open the registry? Whenever I try to open an
>> application I
>> get that error. Hence I can't use regedit.
>>
>>
>>
> You could try renaming regedit.exe to something else, and that sometimes
> helps. Or, try editing the registry in safemode (under your login, of
> course, not the safemode admin login in win XP, which will allow you to
> edit current user rigistry keys). Of course, sometimes it's easier if
> you have backups to just format c:
>
I forgot, you could get into programs w/o start by creating a desktop
shortcut (right click) to the programs you need.

--
William


If it don't work, hit it
If it still don't work, kick it
If it works after hitting it or kicking it, then it doesn't matter if
that helped, what's important is it worked.
 >> Stay informed about: "Cannot find start"..?!? 

"Stellijer" <howapropos.TakeThisOut@hotmail.nospam.com> wrote in message news:Z6q5c.12286$zP2.3678@bignews5.bellsouth.net...

> 1. Does this sound like it was done by a virus or software updating (I updated
> NAV and removed a couple viruses just before this happened)

Incomplete malware removal. A thorough removal should have
fixed this also.

> 2. Any ideas how to open the registry? Whenever I try to open an application I
> get that error. Hence I can't use regedit.

Rename regedit.exe to regedit.com and then run regedit.
 >> Stay informed about: "Cannot find start"..?!? 

Big Will
<SPAMWSPAMiSPAMlSPAMlSPAMBSPAM4SPAMeSPAMvSPAAAAAMeSPAMMITTYrSPAAAAAM@nIeDONTtLIK
EzSPAMero.net> wrote in message news:40563f4c$1@darkstar...
> >
> >
> >
> You could try renaming regedit.exe to something else, and that sometimes
> helps. Or, try editing the registry in safemode (under your login, of
> course, not the safemode admin login in win XP, which will allow you to
> edit current user rigistry keys). Of course, sometimes it's easier if
> you have backups to just format c:


No... renaming didn't help. *NO* executable is working in this manner; doesn't
matter the name.

Safe mode didn't help; it still was looking for the "null" file named "start".

BTW - Windows 98SE is on this machine
 >> Stay informed about: "Cannot find start"..?!? 

Big Will
<SPAMWSPAMiSPAMlSPAMlSPAMBSPAM4SPAMeSPAMvSPAAAAAMeSPAMMITTYrSPAAAAAM@nIeDONTtLIK
EzSPAMero.net> wrote in message news:40563fb3$1@darkstar...
> Big Will wrote:
> >
> I forgot, you could get into programs w/o start by creating a desktop
> shortcut (right click) to the programs you need.


Tried that; it didn't work, either.
 >> Stay informed about: "Cannot find start"..?!? 

Stellijer wrote:

> Big Will
> <SPAMWSPAMiSPAMlSPAMlSPAMBSPAM4SPAMeSPAMvSPAAAAAMeSPAMMITTYrSPAAAAAM@nIeDONTtLIK
> EzSPAMero.net> wrote in message news:40563fb3$1@darkstar...
>
>>Big Will wrote:
>>
>>I forgot, you could get into programs w/o start by creating a desktop
>>shortcut (right click) to the programs you need.
>
>
>
> Tried that; it didn't work, either.
>
>
>
Well, if nothing helps, then create a boot disk (doesn't matter what OS)
in order to backup any files that are important to you, and format.
Hopefully someone else will be able to offer better advice, though, but
you might need to do break out the system restore disks . Also, if
you have access to another computer, I would recommend burning sygate
installation file on a CD so that you could have a FW up when doing all
your updates, should you chose to format (unless you have an FW stored
locally on CD already). And remember, if all else fails, follow advice
in my signature. It might not help, but it might help you feel better.
--
William


If it don't work, hit it
If it still don't work, kick it
If it works after hitting it or kicking it, then it doesn't matter if
that helped, what's important is it worked.
 >> Stay informed about: "Cannot find start"..?!? 

FromTheRafters <!0000@nomad.fake> wrote in message
news:105co2p1qpddt45@corp.supernews.com...
>
> "Stellijer" <howapropos RemoveThis @hotmail.nospam.com> wrote in message
news:Z6q5c.12286$zP2.3678@bignews5.bellsouth.net...
>
> > 1. Does this sound like it was done by a virus or software updating (I
updated
> > NAV and removed a couple viruses just before this happened)
>
> Incomplete malware removal. A thorough removal should have
> fixed this also.
>
> > 2. Any ideas how to open the registry? Whenever I try to open an
application I
> > get that error. Hence I can't use regedit.
>
> Rename regedit.exe to regedit.com and then run regedit.
>
>

OK... a .com file. Didn't think of that. I will give it a try.
 >> Stay informed about: "Cannot find start"..?!? 

"Stellijer" <howapropos RemoveThis @hotmail.nospam.com> wrote in message news:ett5c.39575$xL3.27833@bignews1.bellsouth.net...

> No... renaming didn't help. *NO* executable is working in this manner; doesn't
> matter the name.

No "executable" or no .exe extensioned file?

If comfile, regfile, batfile, scrfile, piffile, exefile are all affected, then
a suitable .reg file renamed to the filename the error message mentions
can perform the registry fix because *it* will run.
 >> Stay informed about: "Cannot find start"..?!? 

Big Will wrote:

> You could try renaming regedit.exe to something else, and that sometimes
> helps.

As a general idea, what do you think of copying regedit.exe and
renaming the copy to, say, "xregedit.exe" of some such? That would
provide a backup repair tool.
 >> Stay informed about: "Cannot find start"..?!? 

"cquirke (MVP Win9x)" <cquirkenews RemoveThis @nospam.mvps.org> wrote in message news:d3jq50d15q5snk1p3geljc214if1c1do6f@4ax.com...

> Let's hear from all those NTFS fans what the equivalent workarounds
> are; no collateral damage a la "repair install", please, and let's not
> assume we have spare XP PCs lying around for drop-in treatment!

I don't have NTFS, but maybe one could still craft a .reg with
the appropriate patchwork and rename it malware.exe?

....or use the commandline.
 >> Stay informed about: "Cannot find start"..?!? 

On Mon, 22 Mar 2004 00:25:03 -0500, "FromTheRafters"
>"cquirke (MVP Win9x)" <cquirkenews RemoveThis @nospam.mvps.org>

>> Let's hear from all those NTFS fans what the equivalent workarounds
>> are; no collateral damage a la "repair install", please, and let's not
>> assume we have spare XP PCs lying around for drop-in treatment!

>I don't have NTFS, but maybe one could still craft a .reg with
>the appropriate patchwork and rename it malware.exe?

>...or use the commandline.

Safe Mode Command Prompt isn't DOS, and so AFAIK it does use file
associations. So if you are there, thus in a position to run Regedit
(by any name, with any file type) you are also potentially running the
malware. Even if FATxx, you can't use Win9x's Regedit to pump in a
..REG fix from a DOS mode boot.

So the only thing that I know of that can pump registry settings
requires the infected OS to run it. Problem.



>-------------------- ----- ---- --- -- - - - -
Running Windows-based av to kill active malware is like striking
a match to see if what you are standing in is water or petrol.
>-------------------- ----- ---- --- -- - - - -
 >> Stay informed about: "Cannot find start"..?!? 

cquirke (MVP Win9x) wrote:
[snip]
> Safe Mode Command Prompt isn't DOS, and so AFAIK it does use file
> associations.

this deserves closer inspection... some associations work and others do
not (ie. txt and jpg work but pdf does not)...

as a test i set up an association to open batch files in notepad, but
at the command prompt that doesn't work either...

> So if you are there, thus in a position to run Regedit
> (by any name, with any file type) you are also potentially running the
> malware.

that remains to be seen...

--
"we're the first ones to starve, we're the first ones to die
the first ones in line for that pie in the sky
and we're always the last when the cream is shared out
for the worker is working when the fat cat's about"
 >> Stay informed about: "Cannot find start"..?!? 

"cquirke (MVP Win9x)" <cquirkenews.TakeThisOut@nospam.mvps.org> wrote in message news:d91v509lgavh1m5ip0p7917uqo1c0343st@4ax.com...
> On Mon, 22 Mar 2004 00:25:03 -0500, "FromTheRafters"
> >"cquirke (MVP Win9x)" <cquirkenews.TakeThisOut@nospam.mvps.org>
>
> >> Let's hear from all those NTFS fans what the equivalent workarounds
> >> are; no collateral damage a la "repair install", please, and let's not
> >> assume we have spare XP PCs lying around for drop-in treatment!
>
> >I don't have NTFS, but maybe one could still craft a .reg with
> >the appropriate patchwork and rename it malware.exe?
>
> >...or use the commandline.
>
> Safe Mode Command Prompt isn't DOS, and so AFAIK it does use file
> associations.

Okay, then the renaming method should work.

> So if you are there, thus in a position to run Regedit
> (by any name, with any file type) you are also potentially running the
> malware.

Assuming the malware was removed (or at the very least the
malwares "startup method" of exefile hijacking was neutered
by eliminating the startup exe (in this case perhaps "start.exe"
was placed before "%1\" %* in the key for exefile and you
have renamed away or removed "start.exe"). If regedit being
renamed to *.com didn't work because the same hijack was
in comfile, regfile, batfile, etc...then you can try this method.

regedit.exe renamed to wormfile.exe (in this case "start.exe")
regfix.reg file renamed to regfix.exe (contains key patches)
double clicking regfix.exe invokes wormfile.exe (regedit.exe)
and passes regfix.exe (regfix.reg) to it as a patch.

> Even if FATxx, you can't use Win9x's Regedit to pump in a
> .REG fix from a DOS mode boot.

> So the only thing that I know of that can pump registry settings
> requires the infected OS to run it. Problem.

Yeah, but not if the *only* problem is that the malware removal
method *forgot* to fix the registry hijacks. I was referring to a
system devoid of malware but "corrupted" registry exefile, comfile,
batfile, regfile, and piffile..etc.. key values.
 >> Stay informed about: "Cannot find start"..?!?