Running Norton - Try a clean boot

Running Norton - Try a clean boot

Secure Home | Search | About
 Anti-Virus Software    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Running Norton - Try a clean boot Clarence \(Lancy\) Howard 03-25-2006
Posted by Clarence \(Lancy\) Howard on March 25, 2006, 4:35 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Hi folks

One for your amusement. If you are running Norton and have a diskette drive
on your machine, then do a clean boot from a diskette.

Change directory to C:_RESTORE\TEMP

Take a directory listing. Do you see the last file in the list? Well.....
delete it. Take another directory listing and ask yourself why there is
another file with a higher name than the one you just deleted.

Interesting, isn't it.

Clarence (Lancy) Howard
nutz7777@ntlworld.com (remove one of the 7s)



Posted by Jake Dodd on March 25, 2006, 5:25 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

> Hi folks
>
> One for your amusement. If you are running Norton and have a diskette drive
> on your machine, then do a clean boot from a diskette.
>
> Change directory to C:_RESTORE\TEMP

You have to be using WinME to have this folder by default. It is a "special"
folder.

> Take a directory listing. Do you see the last file in the list? Well.....
> delete it. Take another directory listing and ask yourself why there is
> another file with a higher name than the one you just deleted.
>
> Interesting, isn't it.

Are you clean booting with a WinME boot disk? What does Norton have
to do with WinME's system restore feature?



Posted by Clarence \(Lancy\) Howard on March 25, 2006, 5:48 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Hi Jake

> > Change directory to C:_RESTORE\TEMP
>
> You have to be using WinME to have this folder by default. It is a
"special"
> folder.

I'm messing around with the machine I had that was faulty. I'm just trying
to find out what was wrong with it.

> > Take a directory listing. Do you see the last file in the list?
Well.....
> > delete it. Take another directory listing and ask yourself why there is
> > another file with a higher name than the one you just deleted.
> >
> > Interesting, isn't it.
>
> Are you clean booting with a WinME boot disk? What does Norton have
> to do with WinME's system restore feature?

Even if I am (or am not), why should it matter what OS I'm booting with???

You seem to know quite a lot about this. I'm intrigued.

Is it WinME that is sticking all these references into the MBR (y'know
1,2,3,......32768)?

What happens when it gets to 32,769?

Is it WinME that is sending dopey code to the CMOS?

What possible benefit could there be to ME by copying semaphore files that
have 0 bytes?

I could ask more questions, but a simple answer to those ones might steer me
on the good path.

I'd be grateful for your suggestions.

Clarence (Lancy) Howard
nutz7777@ntlworld.com (remove one of the 7s)



Posted by Jake Dodd on March 26, 2006, 9:09 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

> Hi Jake

Hi Clarence.

> > > Change directory to C:_RESTORE\TEMP
> >
> > You have to be using WinME to have this folder by default. It is a
> "special"
> > folder.
>
> I'm messing around with the machine I had that was faulty. I'm just trying
> to find out what was wrong with it.

That's good. :)

> > > Take a directory listing. Do you see the last file in the list?
> Well.....
> > > delete it. Take another directory listing and ask yourself why there is
> > > another file with a higher name than the one you just deleted.
> > >
> > > Interesting, isn't it.
> >
> > Are you clean booting with a WinME boot disk? What does Norton have
> > to do with WinME's system restore feature?
>
> Even if I am (or am not), why should it matter what OS I'm booting with???

WinME has a "system restore" feature and "file change monitoring" which may
do things that those more familiar with Win9x may find puzzling.

> You seem to know quite a lot about this. I'm intrigued.

I don't use WinME myself, I was just trying to help clear up some
misconceptions you might have. Sorry if I offended, and I shall not
contimue to do so.

> Is it WinME that is sticking all these references into the MBR (y'know
> 1,2,3,......32768)?

I don't know, but I do know that WinME has system restore which uses
the C:\_restore folder and IIRC there will be at least one file created in
that folder by the system if it is found to be mising. Also, whenever an
executable file is changed (deleted, renamed, or otherwise modified) the
system will attempt to preserve a pre-modification copy of that file in the
somewhere in the _restore directory tree hierarchy..

> What happens when it gets to 32,769?

I don't know.

> Is it WinME that is sending dopey code to the CMOS?

I don't know, and the CMOS shouldn't have code. The CMOS is a storage
area for the BIOS to use to help get the hardware supported and configured.
As far as I know, the only program that should write into the CMOS is the
CMOS setup program in the BIOS.

> What possible benefit could there be to ME by copying semaphore files that
> have 0 bytes?

Semaphore files? - again, I don't know.

> I could ask more questions, but a simple answer to those ones might steer me
> on the good path.
>
> I'd be grateful for your suggestions.

Sorry I can't help you.

You might want to peruse this if you get some spare time:

http://support.microsoft.com/default.aspx?scid=kb;en-us;267951

Windows ME restore feature explained.



Posted by Jake Dodd on March 26, 2006, 9:53 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Hi Clarence (again) :))

More detailed description of WinME (SR) here:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnsetup/html/winmesr.asp



Similar ThreadsPosted
Clean file transfered over net to other clean machine infectable in route? May 28, 2005, 1:26 pm
AVG - In a spin - running alongside Norton - Melissa, you were right! May 28, 2005, 12:40 pm
clean hdd November 28, 2005, 11:04 am
How to clean virus ? June 20, 2008, 11:52 am
CWS Shredder does not clean coolweb August 5, 2005, 7:15 pm
McAfee clean.bat not working November 5, 2006, 11:32 pm
Re: McAfee clean.bat not working November 6, 2006, 10:17 pm
How to clean an infected computer? October 30, 2007, 2:25 am
Crap Cleaner 1.27.260 keeps losing custom folders to clean March 8, 2006, 12:31 pm
Marlboro...cigarettes...for $11.99. Delivery to USA & EUROPE .....When did Zachary clean at all the onions? We can't call farmers unless Mitch will quickly open afterwards. August 12, 2007, 9:06 am

The site map in XML format XML site map

Contact Us | Privacy Policy