I messed up Windows' Networking -> Need Help Please!!

[{NcsO}ReichstaG]

Hello,
Wow, i messed up the networking on my Windows XP Pro. I was running trial Zone Alarm. The Trial Ended, and I decided to uninstall it. I go to Add/Remove and begin to unintall. Waiting for a while, Add/Remove seemed to be frozen. I could not scroll up/down. Nor was there any kind of progress shown that ZA is uninstalling. So i did a hard restart. However, now i can't access the Internet under my profile. So...I can boot into Windows SafeMode with Networking and access the internet. However, when I try logging into my profile, i can't. I tried doing a System Restore, but afterwards, i could not EVEN LOG INTO my profile. I could some error about either nothing have the security rights or files being corrupted to log in. I can undo the restore and log in, but then i don;t have internet. Need Help Please!!

oh...and i hope this is the right sub forum...
-thanks

 

[Ice Czar]

first, its far better to image your OS (clone the partition) and store it offline than to employ restore points
those are warehouses for malware in the event you get infected (in which case the first thing you do is delete them), not that this sounds like a case of infection, and your SAM (Security Accounts Manager) sounds screwed up in the restore point anyway.

having a dual boot and a copy of the registry to repair with could fix that, or severa;
but you have likely already overwritten the last known good configuration having booted a few times (its a copy of your registry kept at WINNT\repair (W2K) or WINDOWS\repair (XP) but its only of the last good boot, internet connectivity or not)

Id say boot into what you can and.....

http://web.archive.org/web/20040202...abs.com/store/content/support/znalm26Main.jsp

Type the following exactly - including any spaces. Delete any folders found:

zonelabs
zone labs
internet logs (NOTE: Your alerts log - ZALogs.txt will be stored here. If for any reason you wish to save your alerts log, simply copy this file to another safe location on your hard drive)
Type the following exactly - delete any of the following files found in C:\Windows, C:\WINNT, or any subfolder below those, or in your \Temp folder:

vsdata.dll
vsdata95.vxd
vsdatant.vxd
vsmonapi.dll
vsnetutils.dll
vspubapi.dll
vsutil.dll (NOTE: Do not remove this file from any McAfee folders)
Type the following exactly - delete any files found in any folder with "Programs" in the pathname):

zonealarm
9. Make sure your Recycle Bin is empty (right-click and select Empty).

10. REBOOT

NOTE: If you received an error message upon deleting the files, or if the original programs remain in the Programs list, or if the problem persists after this, try removing the items mentioned above AFTER following the steps below:

a. Reboot your system into either Safe Mode or to a Command Prompt (by pressing either F8 at the beep when restarting, or holding the Control key during boot).
b. You should now be able to remove the files specified above.

- Step 4 - Reinstall the latest version of ZoneAlarm.
Now you should be able to install the new version you just downloaded cleanly. Be sure to NOT use the old settings as this can cause further difficulties if the database is corrupt.

- Step 5 - Remove registry entries (not usually needed).
It is not generally necessary to remove registry entries if reinstalling ZoneAlarm. However, should you choose to do so, the following registry entries are associated with ZoneAlarm:

Important Advisory: Deleting registry entries incorrectly may cause serious problems to your operating system (OS) which may necessitate the need to reinstall the OS. Please make sure you are able to perform these deletions correctly before you decide to edit the entries.

For information about how to edit the registry in Windows, type "regedit.exe" from a command prompt. Click "Help," then "Help Topic." Click "Changing Keys and Values."

Note that you should back up the registry before you edit it.

To enter the registry, go to Start/Run and type: "regedit." Use Control-F to find and F3 to Find Next.
Registry Entries:

- Key: HKEY_LOCAL_MACHINE\SOFTWARE\Zone Labs and all its subkeys and values.
- Key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\ZoneAlarm

These two registry keys, and all their subkeys, denote the TrueVector service and the TrueVector device driver:

- Key: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\vsmon
- Key: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\vsdatant

This registry key and its subkeys denote ZoneAlarm's alert logging service:

- Key: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\minilog

This is a database that contains a long list of values, but only these values listed below are related to ZoneAlarm and TrueVector. For fastest results, highlight the key below. Click on Edit, then highlight "Find", and type in the files listed below in the "Find what" field (make sure that the "Keys", "Values", and "Data" boxes are checked):

- Key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SharedDLLs
- Values:
vsdata.dll
vsdatant.sys
vsmonapi.dll
vsnetutils.dll
vsnetu.dll
vspubapi.dll
vsutil.dll
html.tdr
vsdb.dll
minilog.exe
vsmon.exe
vsruledb.dll

Also, remove any value that has a path to C:\Program Files\Zone Labs\ZoneAlarm\
For each user who has run ZoneAlarm, there are registry keys in
- Key: HKEY_CURRENT_USER\Software\Zone Labs

The following keys allow the user to modify the sound that is played when there is an alert through use of the Control Panel Sounds applet:

- Key: HKEY_CURRENT_USER\AppEvents\EventLabels\InternetAlert
- Key: HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\InternetAlert\.current

The following keys are related to ZoneAlarm 's MailSafe Feature:

- Key: HKEY_CLASSES_ROOT\ZAMailSafe

For ZoneAlarm, the following keys can be removed:

- Key: HKEY_CLASSES_ROOT\zl0
- Key: HKEY_CLASSES_ROOT\ZAMailSafe

they have removed the manual instructions these days hense the archive linkage
your version is likely mostly the same

that would provide clues as to components your looking for to manually remove
before you touch any registry entries, back it up and put it somewhere you can navigate to easily from the recovery console if need be.

at which point youd try to restablish connectivity

 

[{NcsO}ReichstaG]

Thanks for all of your help! However, i just decided to reformat my C: drive. I have two 200gb Maxtors. i copied all of the important files to the other drive and just reformatted windows. I was afraid that trying to fix this would take more time than just formatting the drive. Also, after a System Restore, i started getting BSOD and could only log in with Safe mode but no networking.

anyway, thanks for your help

 

[djnes]

Add another vote for killing off System Restore. It's a waste of space, gives viruses a place to hide, and rarely solves the issue at hand.