Welcome to Blaisdell's Little Corner of the Web

Windows XP Tips & Tricks Part VII

Windows 98 Tips-n-Tricks I | Windows 98 Tips-n-Tricks II | Windows Me Tips-n-Tricks | Windows XP Front Page | News | | Windows XP Tips-n-Tricks|
| Got a problem in search of a solution? Email Me |  Site Updated 05/23/06
| Windows XP Tips I | Windows XP Tips II | Windows XP Tips III | Windows XP Tips IV | Windows XP V | Windows XP VI | Windows XP Tips VII |
  | Windows XP VIII |

When you double click a folder in My Computer, the search Assistant Opens instead of showing the drive

Reader Dave writes: 

This is a known bug Dave and the Microsoft Knowledgebase has an answer ...........

[Please see: Search Companion Starts If You Double-Click a Folder]

,... however, it does require a Registry Hack. To learn more about the System Registry, please see:

Bo's Tweaky Clean Windows

If you would like to create an automatic Registry Hack, copy the below script (Shown in Red) to notepad. Then save the file to your desktop and name it something like FolderClicksearch.reg. Once saved, double click on the REG file and the system will copy the script into the System Registry for you. However, before performing this trick, please be sure to back up your Registry...trust me, though I hardly ever follow my own advise...you probably should.

Here is the script to copy to Notepad:

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\Drive\shell]
@="none"

Little known Windows XP search problem. 
Not so little if your looking for a file but can not remember the filename

Windows XP makes it relatively simple to locate specific files on your computer. It provides a number of different search criteria that can be used to locate a file, even if you don't know the exact name of the file you are looking for. One of the search criteria you can use is "A word or phrase in the document." However, when you search for files based on the text that you specify, you may notice that files with certain extensions or no file extensions may not appear in the search results. Rest assured it is not a problem specific to your computer, but rather a known issue with Windows XP. This occurs because there is no registered filter for the file type. So in order for a file type to be included in the search results, a valid filter component has to be registered. Otherwise, the file type will be ignored during the search. You can resolve the problem by installing the latest service pack for Windows XP or the Windows XP Compatibility Update. You can find more information about this issue in this knowledge base article.

Take control of your vanishing recourses with these tips:

Loyal reader Sabrina writes:

Bo , another problem...I have been trying to learn adobe Photoshop, and paint shop pro...not getting far ! I think I hate those programs!!! Anyway, I 've been unable to save things, I have been getting notes saying" virtual memory is extremely low>" Before , I downloaded WinZip- in order to open fonts ( another headache ) and started creating- attempting to create with those programs , I never got this note...what can I do to correct it. NOW EVERYTHING IS RUNNING SUPER SLOW( IN SLOW MOTION ALMOST ! ) With out having to buy more memory . Do I clean out the hard drive...how? help ! 

First, it is my duty to inform you that Windows XP handles ZIP formatted folders and files. Yup, you really didn't need to download WinZip at all. Just thought that you should know. What is that they say? Better late than never? Sorry! Still...I use WinZip myself and find it very useful.

The programs that you are speaking of are very graphics intensive and do require an enormous amount of processing and RAM power. That being said, we can free up some memory by not loading some of your system tray items and other items that run during startup. Also, we can dump some of the eye candy which is inherent with XP.

First you need to decide what is necessary and what is just fluff. Only you can determine this.

Take a look in your system tray by the clock. Are there programs which reside that you can easily do without? If there are, then right click on the icon and se if the program itself has an option, depending on the program, look in a section titled Options or preference. You should see an item that says load this program at startup or run at startup or something like that. Choose to disable those features. This will free up some of the upper level memory reserves.

Other items can be halted through the Task Manager. Never halt system programs however. Press Ctrl+Alt+Del once to bring up the task manager. Look on the Processes tab and determine what it is that can be halted for this session of Windows.

If your not going to be connected to the internet during the times that you are running the graphics programs then why do they need to be loaded? For example, some things you may want to disable if they are on the system can include but are not exclusive to:

• msimn.exe 
• msmsgs.exe 
• pctspk.exe 
• rundll32 - this one is vital but if it is needed any program will restart it.

To halt the process for any programs you select simply highlight the program and press the End Process button. Answer yes to the warning message that pops up.

Of course there are others that can be disabled in this manner but only you can determine what ones they are. If you goof and something you have disabled causes errors or problems, simply reboot and they will come back on.

Be sure to exit the Task Manager when finished, as this is also draining recourses.

If you find a program that doesn't seem to have an option to halt it, and you know that you do not want it running at startup you can disable it or cause it to launch manually when you want the program itself to launch. Here is how:

1. Press the Windows Key + R and type: 

services.msc /s 

2. Click OK 
3. The program services window opens 
4. Select the programs that you know are not needed 
5. Right click on them and choose properties 
6. Mid way down on the property sheet you will see three selections which are:

1. Automatic - Starts at the programs predefined times, usually at startup 
2. Manual - Starts only when you call for the program to start by clicking on its icon execution 
3. Disable - Halts all instances of the program from starting.

7. Click Apply 
8. Click OK

The next thing to do is to determine what portion of Windows XP's eye candy you can live without. To determine this, do the following:

1. Right click on My Computer and choose properties or press Windows Key + Pause/Break to bring up the computers property sheet 
2. Choose the Advanced tab 
3. Under Performance choose the Settings button

On this screen you can choose to disable some or all of Windows XP's fluff stuff. You need to determine what you want and what you need. Only you can determine this.

• On the visual affects tab consider what options you want. 
  • If, for example, you let Windows decide, then very little will change. 
  • If you choose Adjust for best appearance then your recourses are going to fall by the wayside as Windows will call up all of the multimedia, visuals, and other recourses hogging utilities. 
  • If you choose the adjust for best performance then the pretty face of Windows XP disappears and the look of a regular Windows 98 machine will return. This doesn't disable any of Windows XP's features but it does remove all of the eye candy. This may be your only option if you intend to run these graphics intensive programs without upgrading memory. 
  • If you choose custom then you can selectively disable some of the fluff and thus gain more recourses. Some things which can be disabled and still keep Win XP's pretty face are:

-Fade or slide menus into view 
-Fade or slide tooltips into view 
-Fade out menu items 
-Show shadows under menus 
-Show shadows under mouse pointer 
-Show translucent selection rectangle 
-Show window contents while dragging 
-Slide open combo boxes 
-Slide taskbar buttons 
-Smooth edges of screen fonts 
-Smooth scroll list boxes 
-Use background image for each folder

1. Switch to the Advanced Tab 

   • Under Process Scheduling, choose Programs 

   • Under Memory usage, well, this becomes a bit of a gamble

• Programs = Click this option if you are using this machine as a workstation, rather than as a server. Your programs will work faster and your system cache size will be the default size that came with Windows XP.

• System Cache = Click this option if you are using this machine as a server, or if you use programs that require a large system cache. Photoshop does require a large read ahead cache so this may be your best bet but it wouldn't hurt to test the programs under each option and determine then the best way to handle these items

• Under Virtual Memory = This becomes a little more involved and it may be best to let Windows handle this. Windows generally does a pretty good job of it but if you absolutely need to handle the virtual memory yourself be causes as to how you allocate that recourse.

What is Virtual Memory anyway?

Virtual Memory is that which is allotted to the hard drive from physical RAM, or that which is swapped from memory to disk, hence the term, "SwapFile". It is slower than regular RAM memory as the program needs to read the hard drive rather than coming straight from memory, but it does free up physical memory for other tasks. However, a good virtual memory cache may allow some programs to at least run on your system. A good rule of thumb is to use three times the amount of installed RAM memory or physical for the swapfile size. So, for example:

If you have 256 MB of physical memory then you would want to allocate 768 MB of hard disk space for virtual memory. 
(3 X 256 = 768 MB.)

There are two schools of thought on rather you want to make the minimum and maximum sizes the same. Those who favor it say that if the size of the swapfile is the same both on the minimum and maximum the swapfile doesn't need to grow and shrink and therefore the virtual memory is more efficient.

I, on the other hand, say balderdash (Always wanted to use that word but never knew where to slip it in)!!! 

I have never noticed any difference in the swapfile being set the same on both ends and I have always felt that Windows itself does a great job at allocating the proper recourse in the swapfile. But, that's just me.

So, now you know the whole story. You will need to play around with these settings to determine what is best for you and the programs described.

Of course we can not exclude the possibility of a virus. I am thinking, in this particular instance of the Slowdown Virus. Be sure that your virus scan engine is up to date along with the definitions and then run a full system scan.

These porn sites are like playing that old game, "Whack a Mole". Every time we fix one, another pops up.
Here is a new twist to an old theme that folks are always struggling with.

Bob writes:

I have never been to the site: (http://sexmaxx.com/freegalleries.htm) but it has attached itsself to my-right click context menu. I am running win-xp and I have looked in the registry for it but I can not find that item. I looked under: HKCR, *, contextmenuhabdlers and also, HKCR, *, folder, contextmenuhabdlers. etc.

Answer: Note: Bob writes that a search for sexmaxx.com in the system registry did the trick...it's always the simple solutions that work. Click here for that instruction.

One way you can bypass a webpage or view it's source with a simple click is to use special JavaScript bookmarks. These are bookmarks where in place of the URL, you add actual javascript like so...

javascript:some-javascript-commands-here

Unfortunately, it appears someone has taken this a step further and has discovered that, anyone allowing javascripting, can be penetrated without so much as a bye your leave or nothing.

To be perfectly honest, this is the first time I have seen this one, so we are going to have to do a little detective work together. Up for it?

In most cases, in order to get such a script to work a file called default.cfg must be loaded onto the victims machine. Just for the heck of it, try doing a search on your system for this file, note the location on the drive and if none of the fixes listed below do the trick, let me know the file attributes to it and the location on the machine in which you found it. This, of course, assumes that someone hasn't discovered another way of making this script work.

You mentioned that you have tried other programs besides SS&D. Have your downloaded and run HiJacThis? If you haven't you will find it on our Featured Freeware Page (Yeah I know, sounding like a broken record huh) at this location:
http://www.uninets.net/~blaisdel/freeware_index.htm#HijackThis

I'll skip the explanation as we have it on that page.

Once you have downloaded and run it, look for the following and have HiJackThis fix them:

 Check, and have Hijack This fix these items:

F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O1 - Hosts: 12.129.205.209 search.netscape.com12.129.205.209 sitefinder.verisign.com
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [msbb] C:\WINDOWS\System32\msbb.exe
O4 - HKLM\..\Run: [updater] C:\Program Files\Common files\updater\wupdater.exe
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P 
O8 - Extra context menu item: Coupons - file://C:\Programiles\couponsandoffers\System\Temp\couponsandoffers_script0.htm 
Extra context menu item: >>> FREE PORN GALLERIES <<< - javascript:{document.location='http://sexmaxx.com/freegalleries.htm';} 
O16 - DPF: {018B7EC3-EECA-11D3-8E71-0000E82C6C0D} - http://www.xxxtoolbar.com/ist/softwares/v3.0/0006.cab
O16 - DPF: {13197ACE-6851-45C3-A7FF-C281324D5489} - http://www.2nd-thought.com/files/install026.exe Networking.exe /AUTOSTART

Reboot, and delete:

C:\Program Files\Common Files\GMT\GMT.exe (folder)

HXDL.EXE
or
HXIUL.EXE
Believed to be spyware - made by a company called Alset . Also known as "HelpExpress". Will install itself if you have previously had Attune by Aveo installed as they're by the same company. Uninstall via Add/Remove programs

 The C:\WINDOWS\System32\msbb.exe file
The UPDATER folder in C:\Program Files\Common files

Also uninstall P2P Networking through Add/Remove Programs. If/when asked whether you also want to remove Altnet components, say 'Yes'.
P2P Networking is a totally useless Kazaa add-on, and it's been reported to be responsible for serious system slowdowns.

Subsequently remove the P2P Networking folder in C:\Windows\System32, if still there.

If this is a not go, then try this:

1. Click Start | Run | type or copy & paste
   regedit 
2. Click OK
3. In the Registry editor hit F3 and fill out sexmaxx.com in the dialog box.
4. Delete every key that contains that in the right-hand-screen by right-clicking the entry and choosing delete.
5. Using F3 will take you to the next one.
6. If any items were found, it may take a reboot for the changes to take effect. If you made no changes, ignore the reboot thingy.

Still a no go?

See if a file,  "MSG{A5BAC1A0-1152-11D8-8FAE-0050BF34FD05}0113.dll" is loaded on your system, send it to the recycle bin (Most likely it will be in  C:\WINDOWS\SYSTEM\ if it is on the machine at all). If it is, do a search for 0113.dll in the system registry and remove it from there as well.  If Windows says that the dll file is in use, restart your system in safe mode (After the pretest hit the F8 key a bunch of times) and remove it from there, then reboot and allow Windows to start normally.

There is a good chance that some of this stuff is being called from your cookie cache or even your temporary file cache. I suggest that you delete your cache and cookie files. I know, it is like hitting a flea with a sledge hammer, but the file has to be called from somewhere and this is the place they usually like to hide in.

Rather than dump a bunch of stuff in the registry when we aren't really sure what we are looking for, lets attempt to do something the safe way. Use the Microsoft Configuration Utility to halt suspicious programs from starting when Windows does. Here is how:

1. Click Start | Run and type or copy & paste:
   MSCONFIG
2. Click Ok
3. The Microsoft Configuration Utility will open
   This is the same as editing the system Registry Keys:
   • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
   • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
   • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
   • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
4. Switch to the Startup Tab
5. Go down through the list and uncheck anything which seems suspicious or out of place
6. When done making your selections, reboot
7. When Windows starts up you will see a dialog that will tell you that Windows is in diagnostic mode, click to checkmark the box which tells Windows not to show this dialog again.
8. If everything seems to run okay, and the problem is gone, it may be safe to delete those file pointers from the keys shown above. I would let the system run under the diagnostics mode for a week or two before doing anything so permanent to be certain that everything is in order.

Possibly a L2Me file?
Still a no go? Ouch, we are getting desperate now. Copy the items below that are in Bold and paste them into Notepad and save it to the desktop as  RemoveL2Me.reg .  Double-click on RemoveL2Me.reg. Answer 'yes' when you're asked whether you'd like to have the contents of your reg file added to the registry, and all Look2Me Registry changes will be undone if they exist. If they don't, the script will be ignored.

 REGEDIT4

[-HKEY_CLASSES_ROOT\CLSID\{DDFFA75A-E81D-4454-89FC-B9FD0631E726}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{DDFFA75A-E81D-4454-89FC-B9FD0631E726}"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Streams\Desktop]
"Taskbar"=-
"Toolbars"=-

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StuckRects2]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StuckRects]  

After rebooting, delete that MSG{A5BAC1A0-1152-11D8-8FAE-0050BF34FD05}0113.dll.

NOTE: Do NOT touch any of the following. They're Windows files: msg.exe, msg711.acm, msgsm32.acm, msgsvc.dll.

Still a no go?

See if the following files are on your system, to look for them all at once simply copy and paste them into the search box as follows:

HXDLAZM*.*,Dist1*.*,saveinstCm*.*,NLNP071*.*,ss_IGN7_setup*.*,superbarinst*.*

Once found, send em to the recycle bin. If Windows says that it is using them, restart in safe mode and kill em that way.
Once done, reboot normally and see if the problem goes away.

Still a no go?

Try an online Trojan Search of your system. Go to:
http://www.trojanscan.com/

You must have MSIE 5.0 or higher for this free scan.

In our same thing only different department, check out these other nasties and possible fixes:

• Spyware, Browser Hijacking, and other fun stuff you have been dealing with
  We are getting more and more of these problem porn site thingies. As this is becoming a big ole headache, not only for you but also for me in constantly writing and rewriting this stuff to you, not that I mind, I don't have a life anyway,
  click here for some fixes that just might work for you.
• Remove a porn site from the right-click MSIE context menu
• Porn sites are getting pushy, so push back with these tips - The last word? God, I hope so!
• Got a Porn Popup Add At Startup? Hint: Think Spyware
  The same thing only different department
• Also in our Same thing only different department:
  Hijacked Internet Search Engine
  • Browser Hijacking, it ain't funny any more

Well, Bob, that is about all I have. If none of this stuff worked for you, I am not really sure what to do next.

Special Note to our Readers:
====================

A new spoofing virus has been detected
The virus is stealing our address and making our readers believe it is from us...it isn't.

As always, never open an attachment, even if you think it is from someone you know. First save it to the hard drive and then run a virus scan using the latest updates. Never, ever, open an attachment without first scanning it.
Thanks,
Bo

Windows pooched a partition on the setup?
Try this:

Gail writes:

The Mystery of the Disappearing System Tray Icons

Question: Sometimes my program icons in the system tray do not sow up. They seem to be loaded, but do not show. Is there a way to fix this? - John

Answer: It's been a problem in XP all along. Don't know if it's a timing issue and/or compatibility issue but there has definitely been a bit of fragility about this area. Usually logging off and logging back on will load up the missing icons.

The fix: Go to Control Panel, then open the Add or Remove Programs Icon.

• Now open the Add/Remove Windows components icon.
• Scroll down to Networking Services,
• Highlight it by clicking on it once
• Click the Details Button
• Look for Universal Plug and Play. If it's checked, uncheck it and click OK all the way out.
• Restart your machine and the System Tray icons should all stay there all the time.

What is that program running at startup anyway?

Many of you are familiar with the 'MSConfig' utility (Start/Run/Msconfig) in Windows, but when you click on the 'Startup' tab to view the list of auto-loading programs, you need help identifying (don't we all!) what each entry does. I have been getting a lot of these types of questions lately. Must be that Santa Claus dropped a new PC down the chiminey eh?

Several Web sites have created wonderful resources for learning more about items that are running in the background of Windows including www.answersthatwork.com (click on the 'Task List' button) and www.pacs-portal.co.uk (click on the 'Startup Tips' button).

USER BEWARE! Be sure you fully understand what you are disabling before doing so. If you don't understand what you are doing, don't do it. Make sure to only make one change at a time and reboot your system after each change to make sure that there are no ill effects.

Improve Your CPU's Performance in XP

Second level Datacache(L2Cache) is very important for the performance of your CPU. Normally, winXP should recognize your CPU and the value of the L2Cache. However, sometimes XP can't do this, so you must tweak it by yourself to improve the performance:

run "regedit";
goto "[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\SecondLevelDataCache";
modify its value by decimalism:
AMD Duron: 64(kb);
CeleronA/celeron2:128;
PII mobile/PIII E(EB)/P4/AMD K6-3/AMD THUNDERBird/Cyrix III:256;
AMD K6-2/PII/PIII katmai/AMD Athlon:512;
PII Xeon/PIII Xeon:1024;
reboot.

Increase Speed By Tweaking Prefetcher Settings

This is a unique technique for XP, which could improve the performance significantly by tweaking the prefetcher. Recommended hardware: PIII 800 or higher, 512M RAM or more.

run "regedit";
goto [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters\EnablePrefetcher];
Set the value to either 0-Disable, 1-App launch prefetch, 2-Boot Prefetch, 3-Both ("3" is recommended).
reboot.

It will decrease the boot time, but double and increase the performance of your XP. Try it!

Clean Your Prefetch To Improve Performance

This is an unique technique for WinXP. We know that it is necessary to wash registry and TEMP files for Win9X/ME/2000 periodically. Prefetch is a new and very useful technique in Windows XP. However, after using XP some time, the prefetch directory can get full of junk and obsolete links in the Prefetch catalog, which can slow down your computer notably. My suggestion is:

open C(system drive):/windows/prefetch;
delete those junk and obsolete files;
reboot.

It is recommended that you do this every month. However, simply deleting all *.PL* files is not recommended. Be selective and remove only those files that no longer apply.

How to disable Windows File Protection (WFP)

Disable Windows File Protection (Windows 2000/XP)
Windows 2000 and XP include a feature called Windows File Protection (WFP), part of the System File Checker, which is intended to avoid some of the common DLL consistency issues. This feature may also block valid attempts to change system files and it can therefore be disabled using this tweak.

Open your registry and find the key below.

Change the value of "SFCDisable" to equal "ffffff9d" to disable WFS or "0" to enable it. The other valid hexadecimal values are:

# 1 - disabled, prompt at boot to re-enable
# 2 - disabled at next boot only, no prompt to re-enable
# 4 - enabled, with popups disabled
# ffffff9d - for completely disabled

Restart Windows for the change to take effect.

Additional Steps for Windows 2000 Service Pack 2 and Windows XP
This setting is disabled in Windows 2000 SP2 and Windows XP, and needs to re-enabled using a hex editor and changing SFC.DLL (or SFC_OS.DLL for Windows XP) following these instructions:

Windows 2000 SP2

1. Make a backup the SFC.DLL in the C:\WINNT\SYSTEM32 directory.
2. Make an additional copy of SFC.DLL called SFC1.DLL and open it in a hex editor.
3. At offset 00006211 (6211h) you should find the values "8B" and "C6". Do not continue if you are unable to find these values.
4. Change the values "8B C6" to read "90 90" and save the changes.
5. Run these commands to update the system files:

copy c:\winnt\system32\sfc1.dll c:\winnt\system32\sfc.dll /y
copy c:\winnt\system32\sfc1.dll c:\winnt\system32\dllcache\sfc.dll /y

6. If you are prompted to insert the Windows CD, click Cancel.
7. Restart Windows for the change to take effect.

Windows XP

1. Make a backup the SFC_OS.DLL in the C:\WINDOWS\SYSTEM32 directory.
2. Make an additional copy of SFC_OS.DLL called SFC_OS1.DLL and open it in a hex editor.
3. Windows XP (no Service Pack)
At offset 0000E2B8 (0E2B8h) you should find the values "8B" and "C6".
Windows XP (Service Pack 1)
At offset 0000E3BB (0E3BBh) you should find the values "8B" and "C6".
4. Do not continue if you are unable to find these values.
5. Change the values "8B C6" to read "90 90" and save the changes.
6. Run these commands to update the system files:

copy c:\windows\system32\sfc_os1.dll c:\windows\system32\sfc_os.dll /y
copy c:\windows\system32\sfc_os1.dll c:\windows\system32\dllcache\sfc_os.dll /y

7. If you are prompted to insert the Windows CD, click Cancel.
8. Restart Windows for the change to take effect.

Once these files have been updated apply the registry setting above.

Note: You must manually modify the operating system files using a hex editor to allow this tweak to disable SFC on Windows 2000 (SP1+) or Windows XP.

Registry Settings
System Key: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
Value Name: SFCDisable
Data Type: REG_DWORD (DWORD Value)
Value Data: 0 = enabled (default), ffffff9d = disabled

Disclaimer: Modifying the registry can cause serious problems that may require you to reinstall your operating system. We cannot guarantee that problems resulting from modifications to the registry can be solved. Use the information provided at your own risk.

Removing files in the System Volume Information

Question: There is a lot of junk files I do not need in System Volume Information. I attempt to get into the folder but get "Access Denied". Is there any way to remove some of the useless data in this folder? - Pat

Answer: Sure Pat. System Volume Information is the section of Windows XP which stores the restore points for future recovery. Any time the system is changed a restore point is created in this section for emergency recovery. Temporarily disabling System Restore should cleanse this folder. Here is how:

1. Click Windows Key + Pause/Break
2. This open the system properties dialog
3. Click on the System Restore tab
4. Click to checkmark "Turn off System Restore on all drives".
5. Click Apply
6. After it is grayed out, you can uncheckmark, "Turn off System Restore on all drives".
7. Click Apply
8. The information in the folder should now be removed and ready to input more restore points.

Creating and organizing right click context menus

• Menu Order Out of Sync
  Think, re-register

Adding to the Right-Click Menu

I've seen this question a few times in the last couple of weeks, so here you go! You may be wondering how some applications add their icon to the context menu provided when you right click a file. Here's one approach that will display a custom application you'd like to add, but only when there isn't already an application associated with the file. For instance, if you right-click on a Word document, Windows will likely know what this is already, and not display your new custom entry. It will show up on the context menu for an unrecognized file type, however. First, navigate to the following registry location:

HKEY_CLASSES_ROOT \ Unknown \ Shell

Right-click on the Shell subkey and choose New - Key. This will add a new subkey below the Shell. Give the new subkey the name of the application as you'd like it displayed on the context menu.

Next, you'll need to create another new subkey under your newly created application subkey called command. There will be a Default value automatically created. Double click this value and enter the full path of the application's executable file, but append a %1 to the end (i.e. c:\winnt\notepad.exe %1). Close the registry editor, then right-click on an unrecognized file type. You should see your new entry.

More on Right-click context menus

There are ways to modify what shows up when you right click on files, folders and drives. Here are the registry keys involved:

HKEY_CLASSES_ROOT \ * \ shellex \ ContextMenuHandlers
HKEY_CLASSES_ROOT \ Directory \ shellex \ ContextMenuHandlers
HKEY_CLASSES_ROOT \ Folder \ shellex \ ContextMenuHandlers
HKEY_CLASSES_ROOT \ Drive \ shellex \ ContextMenuHandlers

By inspecting the items under these keys, you can see which items will appear on the context menu when you right-click on an item, but this will only show you which applications are adding items to the menu. The actual entries are usually controlled by an application's .DLL file. You'll probably find entries similar to this as the data:

{E0D79304-84BE-11CE-9641-444553540000}

This is known as a ClassID and references an entry at the following registry location:

HKEY_CLASSES_ROOT \ CLSID \ {E0D79304-84BE-11CE-9641-444553540000}

Under that key, you'll find the entry pointing to the application executable or .DLL, which is responsible for defining the items actually displayed on the context menu. If you simply want to remove the item from the context menu, remove the entry under the shellex \ ContextMenuHandlers keys shown above, and leave the CLSID items alone, as they are likely used for several purposes by the system.

Menu Order Out of Sync

If the menu order is not quite right, then it may be due to a corrupt Shell32.dll file or a piece of software which has messed you up. If this is the case, you can avoid a ton of heart ache and sore eye strain from looking through the system registry for a cryptic ClassID fix by simply re-registering your Shell32.dll file. Here is how:

1. Click Start | Run (Windows Key + R)
2. Type:
    regsvr32 shell32
3. Hit enter or click okay
4. If the re-registration is accepted, then you will see a dialog that reports:
   "DLLRegisterServer in Shell32 succeeded"
5. Click okay and restart your computer. (The change should be instantaneous but to be safe, lets do it the long way).
6. When your computer restarts into the GUI try your right click Start Button context menu again.

If the file is corrupt, then you will need to extract a new version from your Windows installation CD. the Shell32.dll file resides in C:\Windows\System32. You may be able to extract a working copy from the C:\Windows\System32\dllcach folder otherwise run SFC with the Command switch /scannow with your installation CD in the drive. Don't know how? Here is how:

1. Place your Windows Installation CD into the drive
2. Click Start | Run (Windows Key + R) and type:
   SFC /SCANOW
3. Click okay or hit the enter key on your keyboard

Clean out the MRU's and History Lists
Clear History Lists

So that you can quickly open documents and programs you use frequently, Windows XP keeps history lists. These are most recently used (MRU) lists. Table 2 shows you where in the registry the operating system stores these lists. Sometimes it's useful to clear these history lists so that other people can't see what you've been working on or just to get a fresh start. Clear these lists by removing the keys associated with them. After removing the RecentDocs key, make sure you delete the contents of %USERPROFILE%\Recent, too.

Search Assistant's history list, shown in Table 2, deserves a bit more information. The key ACMru contains different subkeys, depending on the types of things for which you've searched. For example, if you search for files and folders, you'll see the subkey 5603, and that subkey contains a list of the different search strings. If you search the Internet using Search Assistant, you'll see the subkey 5001. You can remove each subkey individually to clear a specific type of query's history list, or you can remove the key ACMru to clear all of Search Assistant's history lists. The table contains a list of the subkeys that I've found in ACMru.

Fix a Balky Burner

If you have a compatible CD burner, you shouldn't need to do anything special to get it working under Windows XP Home Edition or Professional. The core code that makes CD recording possible is enabled automatically when you set up Windows XP. If you're unable to record a CD, start the troubleshooting process by checking to ensure that the feature is properly configured:

1. Open My Computer, right-click the CD Drive icon, and then click Properties.
2. Click the Recording tab to display the settings shown in Figure 1.

Figure 1

• If you don't see a Recording tab, then Windows XP doesn't recognize your CD burner's recording capabilities. Check the Windows Hardware Compatibility List to make sure your drive is on the list. If the drive is listed and you can play CDs, but no Recording tab is visible, you'll need to manually edit the Registry using the instructions in Knowledge Base article, CD-R Drive or CD-RW Drive Is Not Recognized as a Recordable Device.
• Make sure the Enable CD recording on this drive check box is selected. This setting turns on the built-in CD recording features included with Windows XP. The only reason to disable this feature is if you always prefer to use a third-party program and want to avoid any possible conflict between that program and Windows XP.
• Try a slower speed. Instead of choosing the Fastest setting, dial the burning speed back to 18X or even 8X. Your drive may be able to keep up with a less demanding pace.
• And of course, don't overlook the obvious. You do have a blank CD in the drive and the drive is properly connected, right?

If the drive is configured correctly but you end up with coasters instead of readable CDs, check to make sure you've installed Windows XP Service Pack 1. Problems in the original release of Windows XP resulted in problems with certain CD-R drives; these issues were fixed in SP1. For more information, see Knowledge Base article, Compact Disc Recorded in Windows XP Is Missing Files or Folders or Is Unreadable.

After you have updated your Windows XP machine to SP1 or SP1a you may recieve the following warning:
Windows File Protection
Files that are required for Windows to run properly have been replaced by unrecognized versions. To maintain system stability, Windows must restore the original versions of these files. Insert your product CD-ROM now.

Windows File Protection (WFP) prevents programs from replacing critical Windows system files. Programs must not overwrite these files because they are used by the operating system and by other programs. Protecting these files prevents problems with programs and the operating system.

WFP protects critical system files that are installed as part of Windows (for example, files with a .dll, .exe, .ocx, and .sys extension and some True Type fonts). WFP uses the file signatures and catalog files that are generated by code signing to verify if protected system files are the correct Microsoft versions. Replacement of protected system files is supported only through the following mechanisms:

* Windows Service Pack installation using Update.exe
* Hotfixes installed using Hotfix.exe or Update.exe
* Operating system upgrades using Winnt32.exe
* Windows Update

If a program uses a different method to replace protected files, WFP restores the original files. The Windows Installer adheres to WFP when installing critical system files and calls WFP with a request to install or replace the protected file instead of trying to install or replace a protected file itself.

How the WFP Feature Works
The WFP feature provides protection for system files using two mechanisms. The first mechanism runs in the background. This protection is triggered after WFP receives a directory change notification for a file in a protected directory. After WFP receives this notification, WFP determines which file was changed. If the file is protected, WFP looks up the file signature in a catalog file to determine if the new file is the correct version. If the file is not the correct version, WFP replaces the new file with the file from the cache folder (if it is in the cache folder) or from the installation source. WFP searches for the correct file in the following locations, in this order:

1. The cache folder (by default, %systemroot%\system32\dllcache).
2. The network install path, if the system was installed using network install.
3. The Windows CD-ROM, if the system was installed from CD-ROM.

If WFP finds the file in the cache folder or if the installation source is automatically located, WFP silently replaces the file. If WFP cannot automatically find the file in any of these locations, you receive one of the following messages, where file_name is the name of the file that was replaced and product is the Windows product you are using:

*Windows File Protection
Files that are required for Windows to run properly have been replaced by unrecognized versions. To maintain system stability, Windows must restore the original versions of these files. Insert your product CD-ROM now.

*Windows File Protection
Files that are required for Windows to run properly have been replaced by unrecognized versions. To maintain system stability, Windows must restore the original versions of these files. The network location from which these files should be copied, \\server\share, is not available. Contact your system administrator or insert product CD-ROM now.

NOTE: If an administrator is not logged on, WFP cannot display either of these dialog boxes. In this case, WFP displays the dialog box after an administrator logs on. WFP also records an event to the system event log, noting the file replacement attempt. If an administrator cancels the WFP file replacement, an event noting the cancellation is logged. Note that WFP is not a replacement for having properly restricted user accounts and appropriate security policies.

The second protection mechanism that is provided by the WFP feature is the System File Checker (Sfc.exe) tool. At the end of GUI-mode Setup, the System File Checker tool scans all the protected files to make sure that they are not modified by programs that were installed by using an unattended installation. The System File Checker tool also checks all the catalog files that are used to track correct file versions. If any of the catalog files are missing or damaged, WFP renames the affected catalog file and retrieves a cached version of that file from the cache folder. If a cached copy of the catalog file is not available in the cache folder, the WFP feature requests the appropriate media to retrieve a new copy of the catalog file.

The System File Checker tool gives an administrator the ability to scan all the protected files to verify their versions. The System File Checker tool also checks and repopulates the cache folder (by default, %SystemRoot%\System32\Dllcache). If the cache folder becomes damaged or unusable, you can use either the sfc /scanonce command or the sfc /scanboot command at a command prompt to repair the contents of the folder.

The SfcScan value in the following registry key has three possible settings:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
The settings for the SfcScan value are:

* 0x0 = do not scan protected files after restart. (Default value)
* 0x1 = scan all protected files after every restart (set if sfc /scanboot is run).
* 0x2 = scan all protected files one time after a restart (set if sfc /scanonce is run).

By default, all system files are cached in the cache folder, and the default size of the cache is 400 MB. Because of disk space considerations, it may not be desirable to maintain cached versions of all system files in the cache folder. To change the size of the cache, change the setting of the SFCQuota value in the following registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
WFP stores verified file versions in the Dllcache folder on the hard disk. The number of cached files is determined by the setting of the SFCQuota value (the default size is 0xFFFFFFFF, or 400 MB). The administrator can make the setting for the SFCQuota value as large or small as needed. Note that if you set the SFCQuota value to 0xFFFFFFFF, the WFP feature caches all protected system files (approximately 2,700 files).

There are two cases in which the cache folder may not contain copies of all protected files, regardless of the SFCQuota value:

1. Not enough disk space.

*Under Windows XP, WFP stops populating the Dllcache folder when less than (600 MB + maximum size of the page file) of space is available on the hard disk.
**Under Windows 2000, WFP stops populating the Dllcache folder when less than 600 MB of space is available on the hard disk.

2. Network Install.

When Windows 2000 or Windows XP is installed over the network, files in the i386\lang directory are not populated in the Dllcache folder.

Additionally, all drivers in the Driver.cab file are protected, but they are not populated in the Dllcache folder. WFP can restore these files from the Driver.cab file directly without prompting the user for the source media. However, running the sfc /scannow command does populate the files from the Driver.cab file into the Dllcache folder.

If WFP detects a file change and the affected file is not in the cache folder, WFP examines the version of the changed file that the operating system is currently using. If the file that is currently in use is the correct version, WFP copies that version of the file to the cache folder. If the file that is currently in use is not the correct version, or if the file is not cached in the cache folder, WFP tries to locate the installation source. If WFP cannot find the installation source, WFP prompts an administrator to insert the appropriate media to replace the file or the cached file version.

The SFCDllCacheDir value (REG_EXPAND_SZ) in the following registry key specifies the location of the Dllcache folder.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
The default value data for the SFCDllCacheDir value is %SystemRoot%\System32. The SFCDllCacheDir value can be a local path. By default, the SFCDllCacheDir value is not listed in the HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon registry key.
To modify the cache location, you must add this value.

• For additional information about the WFP feature, click the article number below to view the article in the Microsoft Knowledge Base:
  222473 Registry Settings for Windows File Protection
• For additional information about the System File Checker tool in Windows XP and Windows Server 2003, click the following article number to view the article in the Microsoft Knowledge Base:
  310747 Description of Windows XP and Windows Server 2003 System File Checker (Sfc.exe)
• For additional information about the System File Checker tool in Windows 2000, click the following article number to view the article in the Microsoft Knowledge Base:
  222471 Description of the Windows 2000 System File Checker Tool
• For additional information about the WFP feature, visit the following Microsoft Web site:
  http://msdn.microsoft.com/library/en-us/wfp/setup/windows_file_protection_start_page.asp
• For additional information about Windows Installer and WFP, visit the following Microsoft Web site:
  http://msdn.microsoft.com/library/en-us/msi/setup/windows_file_protection_on_windows_2000_and_windows_xp.asp
• Information About the VBS.LOVELETTER Worm Virus

Windows XP -

A 64 bit upgrade to a 32-bit patch for a 16-bit GUI shell running on top of an 8-bit operating system written for a 4-bit processor by a 2-bit company who cannot stand 1 bit of competition (but it's better than a Mac)!

Be advised, All questions submitted to Blaisdell's Little Corner of the Web are the sole property of BLCW and are never open for negotiation or payment of any kind.

I do not allow organizations to use my name or to contact me to make solicitations other than as permitted in my Junkbusters Declaration.

Version Dec 7 Copyright © 2001 Larry Blaisdell