Re: C:\WINNT\SYSTEM32\AUTOEXEC.NT Error .Help plz if you can !!

From: Jim Byrd (jrbyrd_at_spamlessadelphia.net)
Date: 02/05/05 

Date: Fri, 4 Feb 2005 18:35:23 -0800

Hi Peoples - Well, the fix will run on Win2k, but I'm not sure if it's smart
enough to know where to find/replace these on a Win2k box (use %windir%
instead of Windows, etc. and/or on a different partition). We need to ping
Kelly on that one. I would just do the manual replacements per the
Microsoft article,
http://support.microsoft.com/default.aspx?scid=kb;en-us;305521, but also do
the flrman1 fix appropriately adjusted for partition as well and then verify
that things now remain fixed. 

-- 
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP
In news:9BF78CC1-4F1A-4506-93BF-47AD0963035B@microsoft.com,
PeOpLeS <PeOpLeS@discussions.microsoft.com> typed:
> This method all refers to Win XP boxes, Mine are 2K pro Boxes. Will
> this fix still work/. Have youtried it?
>
> Thanks for another avenue to explore.
>
> Anyone else have a view on my probs or above suggested solution.
>
> Again i thank you..
>
> ppls
>
> "Jim Byrd" wrote:
>
>> Hi Peoples - Try this fix, courtesy of MVP Kelly Theiriot:
>>
>>
>> "This installaton program will reinstall the missing or corrupt
>> Windows XP system files command.com, autoexec.nt and config.nt. The
>> absence or corruption of one or more of these files causes a "16 Bit
>> Subsystem" error.
>>
>> XP_Fix.EXE by TRF Systems, Inc.
>> http://www.visualtour.com/downloads/xp_fix.exe
>>
>> More info here:
>>
>> Error Message: MS-DOS or 16-bit Windows-based program
>> http://www.kellys-korner-xp.com/xp_m.htm#16bit"
>>
>>
>> Then, courtesy of flrman1, here:
>> http://forums.techguy.org/archive/index.php/t-280212.html
>>
>> "First in safe mode click on My Computer then click Tools > Folder
>> Options. In Folder options click on the View tab. Under Files and
>> Folders tick "Show hidden files and folders" then uncheck "Hide file
>> extensions for known file types" and uncheck "Hide protected
>> operating system files (recommended)". Now click "Like current
>> folder" then "Apply" and "OK"
>>
>> Now find and delete these files:
>>
>> C:\WINNT\system\windupdate.exe     (added by JB:  note the spelling
>> - the added 'd')
>> C:\WINNT\system.css
>>
>> Delete this folder:
>>
>> c:\freescan
>>
>> Also in safe mode navigate to the C:\Windows\Temp folder. Open the
>> Temp folder and go to Edit > Select All then Edit > Delete to delete
>> the entire contents of the Temp folder.
>>
>> Go to Start > Run and type %temp% in the Run box. The Temp folder
>> will open. Click Edit > Select All then Edit > Delete to delete the
>> entire contents of the Temp folder.
>>
>> Finally go to Control Panel > Internet Options. On the General tab
>> under "Temporary Internet Files" Click "Delete Files". Put a check
>> by "Delete Offline Content" and click OK. Click on the Programs tab
>> then click the "Reset Web Settings" button. Click Apply then OK.
>>
>>
>> Empty the Recycle Bin"
>>
>>
>> Run the fix file again after you're done w/the above.
>>
>> --
>> Please respond in the same thread.
>> Regards, Jim Byrd, MS-MVP
>>
>>
>>
>> In news:E8FBFFCF-47F6-4AFD-A3E7-A761B99A860F@microsoft.com,
>> PeOpLeS <PeOpLeS@discussions.microsoft.com> typed:
>>> Hello all.
>>>
>>> I have tried everything suggested in this post but the problem is
>>> solved ONLY until you either you logo off or reboot the workstation.
>>> The the problem is straight back. :(
>>>
>>> Can anyone else suggest a perminate fix??
>>>
>>> Thanks for any further assistance.
>>>
>>> Ppls
>>>
>>> "George Hester" wrote:
>>>
>>>> Somehow its practice is to delete that file at startup.  I don't
>>>> understand the significance of this unless it is just supposed to
>>>> kill their Win16 subsystem.  I don't know.  It's a strange influx
>>>> of this issue that's for sure.  What they can try to do is remove
>>>> ALL permissions for it and then reboot and see if it disappears
>>>> again. Likely not but they might get a Server Management error at
>>>> boot and track it to what fired the call to autoexecnt.
>>>>
>>>> --
>>>> George Hester
>>>> _________________________________
>>>> "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
>>>> news:#FHzc2ABFHA.1296@TK2MSFTNGP10.phx.gbl...
>>>>> I have heard a similar claim, but only tied to WinXP and AVAST --
>>>>> so far....
>>>>>
>>>>> But, on the other hand, there are definitely malware using
>>>>> AUTOEXEC.NT as an execution vector.  It seems to be more prevalent
>>>>> under WinXP.  I had a LAN user who didn't practice Safe Hex and
>>>>> she was infected with non-viral malware that included Blazefind.
>>>>> While I cleaned her platform, I never narrowed down what was
>>>>> screwing with AUTOEXEC.NT.
>>>>>
>>>>> --
>>>>> Dave
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> "George Hester" <hesterloli@hotmail.com> wrote in message
>>>>> news:%23RLlpwABFHA.824@TK2MSFTNGP11.phx.gbl...
>>>>> I believe it is AV software that is causing this.  This newsgroup
>>>>> has undergone an exceptional amount of these issues in the last
>>>>> month or so.  I read somewhere it could also be a result of AV
>>>>> software.
>>>>>
>>>>> --
>>>>> George Hester