Cannot shut down system restore in Windows ME 2

[WhiteTornado]

Hi,

I am trying to clean up the W32 Yaha.K MM virus. I downloaded the fix from Symantec to clean it up, as per the procedure I have to disable system restore in Windows ME, but when I do that it has me reboot and the bloody thing comes back enabled, I have tried 4 times, in safe more or normal and it keeps on getting put back on!!

Am I missing something or could this be part of the virus trick... there is no mention of this problem on the Symantec site.

Cheers!

 

[ttodd]

did you try flushing out all temp files / cache files/ recycle bin? Then go into msconfig and remove PC health load qm and any thing else you see you don't need. Then go out of msconfig, skip the restart here, go up to muy computer and then the path to disable system restore. then reboot.

 

[MiggyD]

Think you may need a registry hak. Also, I didn't know 95/98 had MS's System Restore...thought it was incorporated in WinME, but I've been wrong before.

I'm currently on a WinME, so I hope this proves fruitful:


Go to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

Block out:
"*StateMgr"="C:\\WINDOWS\\System\\Restore\\StateMgr.exe"


You may also want to check if this applies as well...
Go to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Block out:
"PCHealth"="C:\\WINDOWS\\PCHealth\\Support\\PCHSchd.exe -s"
(Note that this program starts in silent {-s} mode)


Let us know what happens.
--MiggyD.

 

[MiggyD]

This IS the Windows 95/98 forum; but you did indicate WinME. Guess, I need to slow down my reading speed.

You may also want to check out "SFP" on the MS site:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;253571

Please note, it states "...note that SFP cannot be turned off." But, it doesn't hurt to try the above registry edits.

--MiggyD

 

[WhiteTornado]

Hi and tks for these great tips. I did not get to read your answers till a few days later, I found where Windows ME stores his restore files and I search for all of them and deleted them all, then I redid the virus handling, I did a few time, in safe mode and out of safe mode. I must have gotten all of them as I did not get any further messages to the effect that infected files were present. From what I read Windows ME rebuilds these restore files from scratch when you delete them. So I figure that was a safe enough move.

But, I have other machines with Windows ME to fix up and I will get a chance to put your tips into effect.

Cheers!

 

[MiggyD]

Any updates?

 

[ttodd]

wanted to ask MiggyD ., where is the ME site?? In my opening start up page for tech tips forum615 only have windows 95/98 and XP pro ., and browser issues for IT professionals..

 

[MiggyD]

Well...you have two options:

1) Type-in, at the very top of this page, Windows ME in the box next to "SEARCH". Make sure the box next to it says "Find A Forum" (if not, scroll the dropdown list); and click "GO".

2) OR, click here forum748 for "faster" service. ;-)

--MiggyD

 

[ttodd]

Ah Yes..,, Should have studied the page more closely..
thanks