Computer running Windows ME. Hit by virus on the Internet. Mouse arrow does not show up in regular mode of OS, but works in Safe Mode. Have run Ad-Aware and Spybot S&D in SafeMode - 8 items removed. Ran HJT and removed 4 items. Still no mouse in regular mode. Any suggestions?

Have you tried to reinstall the manufacturer driver?

My standard spiel:

---------------------------------------------------------------------------------------------------------------
RECOVER USING BACKUPS
The easy way to recover from all software [including configuration] problems [without even having to discover the cause], is:

1) As you proceed forward in time, make backups of everything on your C: drive.
Do this at regular intervals, particularly before making software changes [un/installing programs or changing configuration] and keep a log of all this.
2) When you hit trouble caused by a bad configuration change and no hardware or software changes have been made, [use "scanreg /restore" in Win98, or a restore point in WinXP, to] restore a previous good configuration.
3) When the trouble involves more than just the configuration, and involves the files [including the configuration perhaps] but no hardware has been changed [this is important because the software must match the hardware], then:
----------------------------------------------------------
Re-format the C: drive and restore your latest good backup.
----------------------------------------------------------
The software will "jump back" to the way it was when the PC worked.
If this doesn’t fix things, then it probably is not a software problem but a hardware problem.

It helps if you keep the C: drive "lean & mean".
I move as much as possible off the C: drive [and keep it as small as possible].
The "Windows" & "Program Files" folders account for 95% of the used space on my C: drive.
All the data that changes day by day [or are considered vital] are re-homed on another physical drive [although another partition would do].
When I "jump back" I still have up to date:
a. My Documents. [Use “TweakUI” to move their home]
b. E-mails for all identities. [use the email client to move their home]
c. Internet Explorer Favourites. [Use “TweakUI” to move their home]
d. Temporary Internet Files. [use the browser (Internet Explorer) to move them]
e. Re-home the Windows Address Book as shown here http://tinyurl.com/24q6l . Use the key “HKEY_CURRENT_USER\Software\Microsoft\WAB\WAB4\Wab FileName” to specify its new address. [Its normal home address [in Win98] is C:\WINDOWS\Application Data\Microsoft\Address Book\(the name you gave your PC).WAB]
f. Any other storage of data files you wouldn’t want to “jump back”.

These can be backed up separately and more or less often.

----------------------------------------------------------------------------------------------------------------
QUOTE
The AVG Rescue Disk is a special diskette where the most important parts of your computer’s boot up data will be saved. In this backup diskette, the contents of the Partition Table, Boot sectors and some other internal data will be saved. These areas are often targets of computer virus attacks and their damage can (and mostly will) cause the malfunction of the whole operating system – your computer cannot be started.

Repairing such destruction can be very difficult job. But if you have a backup copy, restoring the damaged areas is easy and safe.

In addition to the backup copy of the system areas there is a special AVG-SOS program stored on the rescue disk to handle the saved data.
------------------------------------------------------------------------------------------------------------------

I love it when Sylvander does that...:)

That is GREAT advice.

But, in the case you do not have a backup (should only happen once to most of us), you can:

1)check the status of your mouse driver in Windows Device Manager
2)reinstall driver from there if possible
3)If not, download Belarc Advisor (works also with Win ME). Run it and make a note of your mobo's model number (I just learned of that program yesterday--thanks Ski)
4)check the manufacturer's website for the correct drivers
5)reinstall the driver (which John0904 recommended)

While I'm on the stage, may I ask how you know you had a virus? How did you know what to fix in HijackThis? Are you using any sort of special mouse (usb, optical, etc.)?

At any rate, I think it is wise to first check the driver scenario out first. Should be a quick fix--unless you 'fixed' something you shouldn't have with hjt.

Three questions:

1. Have you tried your System Restore function (edit: start > programs > accessories > system tools > system restore) to restore it to a date when the mouse was in good working order? Do not restore it to date when you had the virus.

2. When you cleansed the virus did you disable/re-enable the System Restore files? If you did or if you do that now you will lose all your past restore dates.

3. Did you unplug the mouse while the machine was either on, or-- off but still plugged in? If you did, it is possible that the port is damaged.



:cool:

John0904

Thanks for responding. I cannot reinstall the manufacturer driver because I can only get the mouse to work in Safe Mode. In Safe Mode, I have no access to the Internet to download drivers or to CD drives or to USB flash drive.

Sylvander

Thanks for your reply. I'll work on this process.

newbie2004

Appreciate the reply. Still, I am operating in Safe Mode and cannot reinstall the drivers or download. Mouse in Device Manager shows that it's functioning properly. Curious: besides the PS/2 mouse, there's an HID-compliant mouse - what's that doing there?

Donn

Thanks again for your response.

System Restore does not open for me in Safe Mode.

Have not disabled System Restore.

Mouse was not unplugged while still on. Computer will not recognize a PS/2 mouse or a USB mouse.

Thanks to you all. I'm taking off for my son's school program. Will get back to you on Monday. I'll try Sylvander's suggestions at that time.

SWCS

Unless I missed it, you still haven't identified the virus, or mentioned what you did about it. That would help. Was this a virus per se or a trojan or a worm, did you get a name or a file for it?

1. DO NOT use system restore, after being infected with a virus any and all restore points are considered unsafe.

2. If you haven't yet, turn system restore off and get rid of the virus. Turn system restore off, reboot and turn it on either way. Be sure the virus is gone before turning system restore back on.

3. In most cases, mouse drivers are not needed, they are built into Windows. Remove the mouse while in Safe Mode, reboot and it should automagically reinstall native drivers, no need to download a thing. That goes for any Windows OS since 95.

an HID compliant mouse:

http://radarsync.ecnext.com/coms2/radarsyncdriver_M_Microsoft_1793

could be the original mouse this box came with, if someone else didn't install it after purchase.

Maybe removing the extra mouse (unneeded) from device manager and then restarting would do the trick?

Also a question regarding Sylvander's post:
not exactly related, but would the AVG rescue diskette, in conjunction with a good backup (say from 'Ghost', along with reformatting the drive) from a known clean point in time also clean the system of any viruses?

I don't want to distract from the problem at hand, so please hold off on any replies to my question until SWCS's problem is fixed.

I am overwhelmed by the response. I really appreciate all the help.

Sylvander -

What is going on when the mouse works in Safe Mode but not in regular mode? That sounds to me like something is running in the background that is interfering with the mouse, something that is not running in Safe Mode. Does this problem necessitate reformatting the hard drive?

Newbie2004

Virus symptoms: while on the Internet, suddenly the mouse stopped working and then the computer just shut down. When restarted, no mouse pointer.

I researched the HJT items on the Internet and figured out from there what to delete. One entry was pure random letters (lawgcwc.exe) and another was junk (Dale Setup Acid.exe), both not found on the Internet. The other three I removed were found on the Internet as items to be fixed in HJT.

Both USB and PS/2 mouse have been used with this computer.

I've tried the driver scenario, but the driver is too big for a floppy - and USB flash drive and CD are not recognized in Safe Mode.

Donn -

I tried the System Restore. It locked up with "Rstrui caused an error in KERNEL32.DLL"

I have not disabled the System Restore. I do not do that until the computer is clean of infection.

I have not identified the virus to this point. I am going to run some programs this morning (Stinger, etc.) to see if I can find the name out. Ad-Aware and Spybot S&D did not identify the malware causing this problem.

Paleo Pete -

Isn't turning off System Restore a last ditch effort?

I removed the mouse in Safe Mode and rebooted. In the reboot, a message came up informing me that there was no mouse. The system is therefore detecting the mouse, but not showing it on the Windows screen. The drivers must be loaded, right?

Donn -

Computer has been using only the PS/2 mouse, except for a USB mouse.

newbie2004 -

Removed the HID mouse from device manager, and that did not affect the situation.

All in all, this seems to be something in the StartUp files that is interfering with the mouse from working properly. In MSConfig/system.ini/[default], I found a list of items followed by a double-space, then another item that was all gibberish (
IIIIII/I/O?PO8P and so on) - this item I unchecked but it did not remedy the mouse problem.

Thanks for your help.

SWCS

Thanks to all of you. I tried several of your suggestions. The Windows ME repair did the trick. Mouse now works. Again, thanks.

FYI, the following Trojan Horses were detected by AVG: Dropper.Swicer.A, Downloader.Intexp.A, Downloader.Swizzor.BG, and Downloader.Small.4.AH.

SWCS

SWCS:

"I have not disabled the System Restore. I do not do that until the computer is clean of infection."

Negative, sir, that is exxactly what you MUST do to clean your system-- formal lesson:

in Win ME:

http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm

(the Symantec URl for this is not working, for me anyway, the one above is simpler anyway)

You may also want to keep these handy:

Trojan Hunter trial version:
http://www.misec.net/
Trojan Scan:
http://www.windowsecurity.com/trojanscan/
SWATIT:
http://swatit.org/download.html

When I use them I run them from Safe Mode

Read this, you can learn a lot here about Win ME:

Me set up page, Trev:
http://www.burzurq.com/forum/trevtweak.html

Whenever I have had trojan or virus infections in the past, I always take the time to do a general clean out after clean them out:

In safe mode:

Open IE browser (even if you are off-line) Tools > Internet Options> General Tab > Delete files > check the box to delete off line content > click ok > delete cookies > click ok.

%TEMP% files:
Dble click My Computer icon on desk top > type %TEMP% in the address bar > click enter > delete all you can delete.

Empty recycle bin.

Go to start > Programs > Accessories > System Tools > Run Disk Clean-Up, then scan disk, if scan disk tells you there are programs running in the background-- use ctrl+alt+delete-- and end-task on everything EXCEPT systray and explorer, then run scan disk > then defragmenter.

I also use a tool called RegSeeker, I use it before Defrag, and at other times, but that's just my preference. It is easy to use and you can check the box lower left to make sure it maes you a back-up file before deleting.

Edit: if you have (had) trojans you may have picked up other adware/spywarre. Threfore I would update both spybot and adaware and run them both from Safe Mode, eliminate and delete all they find. Also, while you are in Safe Mode, run your AV again.

:cool:

Before claiming victory try Trend /Micro's Housecall (http://housecall.trendmicro.com/) for an online scan.

If all comes clean, then do spyware checks with Spybot S&W, AdAware and SwatIt Clean critical items those programs suggest. Then, DO AS Pete says and disable System Restore. Reboot and reenable it. This will cleanse any lurking remnants of malware from the restore points. It is NOT a last ditch effort but rather normal procedure when wringing out your pc of infections.

A format and reinstall of your operating system is the last ditch we normally take.

Oh, and a Hijack This log post here would be a good idea as well. Then when all is clean, make sure you have a good firewall, antivirus soft, Spyware Guard, SpywareBlaster and start using FireFox or Mozilla browsers instead of IE

EDIT: Donn, you beat me to the punch ;)

“ What is going on when the mouse works in Safe Mode but not in regular mode? That sounds to me like something is running in the background that is interfering with the mouse, something that is not running in Safe Mode.”
A logical conclusion I’d say.
So this is a software problem.

“ Does this problem necessitate reformatting the hard drive?”
Not if you can find an easier or quicker way.
But I find re-formatting [takes 5 or 10 minutes] and restoring a backup [takes half to one hour whilst watching TV or whatever] so easy that I often prefer that method to any other. [Re-building the software is NOT easy or quick and should come low down on the list of choices.]
Finding the particular tweak to fix it can be time consuming and troublesome and may end in failure anyway, whereas the method I use has never failed and always takes the same minimal effort.

Sylvander,
And by now you must be able to do it with your eyes closed! :D

My mind goes into automatic mode as I yet again complete the same sequence of actions in response to the same prompts.
And it always has the same successful completion. :D
Yet again, PROBLEM SOLVED [usually].
BRILLIANT ! :cool: :D