Win Registry wrong path

[Eaglefeather]

Win98se, AMD K7S5A mb w/Duron 1gig chip

From many other posts I followed suggestions and downloaded Sygate- Search and Destroy.

I had been running Adaware, but spybot found 30 that adaware had missed.

However it also listed some problems, some of which it was able to fix other is could not.

The following are Windows Registry items that is tells me have "Wrong app path". How do I go about fixing these?

Windows Registry: Devices.exe
C:\Program Files\Devices\MainBoard\Devices.exe
Wrong app path.

Windows Registry: MsoHtmEd.exe
Wrong app path

Windows Registry: VGA.exe
C:\WINDOWS\VGA.EXE
Wrong app path.

Windows Registry: AutoSetup.exe
C:\WINDOWS\Start Menu\Programs\Utilities\StartUp\AutoSetup.exe
Wrong app path.

Windows Registry: IDE.EXE
C:\WINDOWS\IDE.EXE
Wrong app path.

All help is appreciated.

[ktkendall]

You can exit to DOS, and type::
scanreg /fix
That is Microsoft's built in registry fixxer though and I'm not sure it would touch those things you have listed as errors.
I have to wonder about some of those programs though that report all those errors, but are there any actual problems with your PC??
There are registry cleanup programs available for free out there too.

[Eaglefeather]

Hi kt, actually the system is running really great right now. Much better than before that virus hit last week.

The only noticable thing is that on boot up, I am getting the pop up for, "open with." It started popping up on boot a couple of days ago. I have checked msconfig startup but there is nothing new there, I only have systray, my AV and ZA set for startup.

Will wait for a bit and see if there are any other suggestions before I try DOS. Mainly because DOS doesn't like me very much.

[reboot]

I have found it's best to ignore Spybot's "Wrong app path" errors. They usually refer to programs that have been uninstalled, but the registry still contains the entries. It will do no harm to leave them be.
Can you explain more about the "open with" popup you are getting? It could be a remnant of the virus, something in system.ini (a line beginning with: run= ) and now that the virus is gone, the reg (or system.ini or win.ini) is still trying to run it.

[Eaglefeather]

Hi Jim, it is the pop up you get if you are in windows explorer and you click on a file that can not open by itself. It asks you which program you would like to use to open it.

Interesting you should mention about that virus. While trying to see if I could find out to which program the files might belong I found the following line in the C:\windows\win.ini window of the System Configuration Editor:

;Rem TShoot: run=C:\WINDOWS\BRASIL.PIFc:\windows\Brasil.pif,c:\windows\instit.bat,c:\windows\alevir.exe,c:\window s\Brasil.exe,c:\windows\scrsvr.exe,c:\windows\marco!.scr

All of those files are from the virus and trojan that invaded my system. According to Symantec, if I remember correctly, Brasil.exe is the main file that held the virus. All of the other files are also mentioned by Symantec as being part of the w95.dupator1503 virus and the opaserv trojan.

I was going to ask about this line and what I should do about it but held off because I didn't want to try balancing too many things at the same time. I felt the files were safely contained behind the remark for the time being. Now that the subject has come up, what would you suggest I do?

[reboot]

I would delete that line completely.
Next thing is to find out what's trying to run, and why.
It's trying to run something at startup that windows doesn't have an association for.
You should be able to find it. It's got to be in win.ini, system.ini, or the startup tab (which is stuff that's in the registry under the HKLM/Software/Microsoft/Current Version/Run folder (and could be elsewhere).
Something you may want to try, if you use the standard associations, download and install TweakUI (if you haven't got it already) and on the Repair tab, check it to repair associations.
Whatever is trying to start and creating that popup, should be able to run unhindered then. Hopefully it's a legitimate windows app/service, and not another trojan. If you're positive your system is clean, then you could try it.
If you still get the popup after that, take all the tick marks out of the startup tab, and add them back one at a time to find the culprit.

[Eaglefeather]

I downloaded Tweak UI and the upgrade and installed both, even though MS tried to make it as difficult as possible to do.

I first ran my AV then went out on the net and ran a couple of online AV's just as a double/triple check. All gave my PC a clean bill of health in that regard.

Then I ran repair associations. It didn't do a thing. I ran spybot right after and the received the same messages in regards to associations.

I found out what program was was using the "Open with" pop up, it was, StartPageGuard, I had disabled it in msconfig startup. I turned it back on then unistalled the program completely, don't think I need it with spybot. So that one is now solved. Ty Jim.

When I answered kt's suggestions, I had forgotten about the, "Cut/Copy and Paste" not working in Wordpad when I was in IE. It works outside it with no problems. If I want to save anything to the clipboard from IE I must now use NotePad. I opened a seperate thread on this one.

Everything else seems to be working pretty well considering the mess this machine was in last week. I guess you folks will make a tech out of me yet.

And I must say I am truly grateful.