Windows XP returns to default

System:
P4 2.6
512 Ram
120 HD
Radeon X800
XP Pro, SP2

I have read through many of the threads and tried alot of fixes (including the Spyware Trojans and Virus Removal stickey) but have yet to find a solution.

As far as I can tell, Windows sets itself to default settings each time I reboot. It offers to give a tour of XP, asks if I just plugged in speakers (the speakers I've had installed for 2+ years) and the visual themes/desktop are reset to what they were out of the box. My files do not seem affected, and I can usually set a new background photo temporarily. However, I often need to reinstall programs (i.e., if I want to open a Word document, windows proceeds to install office) or if I open a game, the software functions as if I am a first time user while i proceed to load a file that is ages old (and occasionally minimizes for no apparent reason).

It seems like my computer has amnesia all of a sudden, a la 50 first dates.

Like I said, I have tried several fixes, the virus and trojan removal guide helped me clean out some adware, and I update and use norton very regularly, which keeps me pretty clean of viruses. But windows still resets and pretends like I've never existed. Any thoughts?

 

this may not be right but here goes my guess, the CMOS battery on your mobo?
Thats all i can think of this early,what are you logging on as admin--user--etc?
sounds like its been good to you up till now.

hoprthathelped

 

Yeah that might be a good idea to try. But wait... windows is on the hard drive and if he was haveing battery trouble BIOS would say that the battery is low. And the battery only affects CMOS and if his CMOS battery was dead the BIOS would be erased which wouldnt allow him to boot up. And windows resides on the hd. Which doesnt need a backup battery. I personally think its either a corrupt registry or corrupt windows install. Try useing registry mechanic and see if that helps. Its made by PC Tools. It will clean out registry problems. Or wait! was it happening before? If it didnt happen at one point try doing a system restore to the point before it happened. If you dont have that do the registry mechanic scan. Heres a link. http://www.pctools.com/registry-mechanic/
Try that program and come back and tell me if it helped.
-the new tech guy

 

Ran the Reg Mechanic and fixed 15 errors. I couldn't fix the deep scan errors because I'm too poor to buy a license right now. I'm still having problems though.

I am logged on as the administrator. I thought I'd look into the CMOS battery just to be sure, so I read through some troubleshooting in other threads and cracked open the case, my board is still getting power, so that doesn't seem to be the problem - unless I misunderstood what the battery does. I also created a new user, logged off and logged back on, but I'm still having the same problems.

The computer has been very faithful for almost three years now with only the occasional virus problem. I started having this issue about a week ago. I did try doing a system restore (I went as far back as three months ago) but I received a message saying no changes were made to my computer. After following the instructions in the Trojan removal stickey, my restore points are gone now anyway, since one step requires turning off the service. I have also tried a diagnostic startup, but that hasn't been effective either.

I do now get a message upon booting up that MS Updater has requested an upgrade (i'll write down the exact wording if you need it). I also can't change the windows theme anymore to my beloved XP Classice because "Visual themes failed to load." So, I believe that there must be something really sinister hiding in my registry, but that's as far as my thinking takes me. I'm going to run through some of the stickey again in an hour or so, just to be sure I didn't miss anything.

 

Please do 2 things for me.

Download, install and run EVEREST Home Edition

When you run the program do the following:

Click-on Report in the File Menu

Select Report Wizard

Click-on Next

Click-on System Summary Only

Click-on Next

Click-on Plain Text

Click-on Finish

Click-on Save To File

Browse to My Documents

Accept the default file name, close the report wizard and everest. POst the report as an attachement.

Download and install Process Explorer.

After you have it installed, run the program;

Click-on File

Select Save as

Save the file to My Documents.

Post the report as an attachment.

 

Well yeah i was just thinking about that virus. If your antivirus is intact update it and do a scan for viruses and see what comes up.
-the new tech guy

 

I did virus scan using Norton, which was last updated on the 17th and didn't call for any new definitions. Some spyware popped up so I deleted it and then followed the instructions to get these reports.

 

Your system is infected with the SearchMiracle.EliteBar.

You have two running processes that are not legimate windows processes. They are:

Etzov.exe
pokapoka63.exe

Please follow the instructions in this thread:

READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

Second any unresolved issues in the Spyware Specific Forum

Read the following thread:

NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting

 

le_pig, do you have an anti spyware program like adaware or something to that affect. If you do not i want you do download adaware and once it is installed check for a definitions file update and install if found. Heres a link: http://www.download.com/Ad-Aware-SE...045910.html?part=dl-ad-aware&subj=dl&tag=top5
Once that is done do a full system scan. Come back and let me know what comes up.
-the new tech guy

 

I followed the instructions in the spyware/trojan removal faq and thought I had gotten everything but Shadow_Puter_Dude was right, I still had the EliteBar on my system. Whenever I ran Ad-aware, elitebar kept showing up. One of my students gave me a copy of a program called ETRemover_V201, I ran it and now my system shows up clean on all scans. I also haven't had anymore problems with XP resetting.

I think EliteBar must have been hiding somewhere else, like in the RAM or something where spyware tools couldn't get to it. They would just erase the Registry keys but the program would still be there I guess. That's just my theory. It's all a bit over my head, but I am hoping my computer is cured now.

 

Well lets hope the problems fixed. Glad to hear your working now though. If you have more trouble come back and let us know.
-the new tech guy