Dr. Watson Fix

So far, yes...the people that have writen me have been soooo happy to have the computers run.  The fix I am suggesting is reversible if not successfull, but so far, anyone that has tried it has fixed the problem.  So far as I can tell, this is the only true fix to this problem.........I am not a computer nerd, I just love computers and it is a challenge to me to fix one--and I fixed it.  So, Yes, try it.

Donna

Message Edited by ora1313 on 04-11-2005 09:40 AM

Ora,

I've been in touch with SpotCheckBilly, and with his permission, I think it's important to bring out what I believe to be some critical points here.  The quotes (in blue) are his.  Please do not take this as a personal attack... rather, my only intent here is to be helpful to other readers in this forum.

First, as I know you're already aware, there is a Fake Microsoft Security Trojan on the Loose -- a spam e-mail which advocates that one should "Update your windows machine" by downloading an "Urgent Windows Update".  Upon clicking on the supplied link, you are transferred to a Web site which fakes the appearance of the Microsoft Windows Update Site, but in reality, is operated by hackers, and installs a Trojan horse program (called DSNX-05) on your system.  This alleged "update" is in fact a phony update... it is NOT legitimate.  But as a consequence of this bad download, people have indeed been experiencing some very severe problems, and blaming their troubles on downloading/updating XP SP2. 

In contrast, the legitimate "sp2 update (from the real Microsoft Windows Update site) and its subsequent patches should ALWAYS be installed, unless there is some very compelling reason not to" do so.  By removing SP2, you are in fact compromising your PC's security.  In fact, at some future point, in order to get later updates, XP users will have to install SP2 first.   For those who've already installed it (from the legitimate sites), it's "ill-advised" to advocate they remove it.  In short, SP2 is a highly important/valuable addition to the Windows XP operating system, and should NOT be removed.

As for removing Dr. Watson:  "Every case of the 'Dr. Watson postmortem debugger' problem that" Billy has "come across has been a result of one of the CWS (Cool Web Search) variants".  It should be kept in mind that  "Dr. Watson is a legitimate diagnostic tool for the Windows operating system".  As such, it shouldn't be simply discarded.  

Now Ora, I understand your desire to step-in and argue (paraphrasing what I believe to be your contention) "But my fix really works... several people have all told me that, by removing Dr. Watson, they no longer experienced this error".  And yes, you're correct... as far as the literal meaning here.  But here's the analogy to your advice, as crazy as this may seem to you:   Suppose a person came to you, in great pain, suffering from a broken arm.  You COULD tell that person he/she needs an amputation.  That certainly would 'work', in the sense that it would take care of their pain.  No more pain....  And no more broken arm.   But the problem now is, much more simply, no more ARM!  That person can no longer reach for things, or write, or do the usual tasks that had been performed with that arm.   And, by analogy, THIS is what you're advocating when you tell people to remove (i.e., cut off) Dr. Watson.  They will lose access to a potentially valuable debugging tool.  I'm sure we all would agree that instead of amputating one's arm, the far-preferable approach is to set it... likewise, rather than removing Dr. Watson, it would be far-better to repair it.

So, I would suggest that all readers out there take SpotCheckBilly's good advice... find the proper fix for Dr. Watson... don't just settle for its "amputation". 

And don't give up on SP2.

I do have a couple of questions for you, and a few comments:

I do run norton and I keep it updated, how did this slip through if it is a Trojan?  Also, why didn't it pick it up when I ran a scan after the problem started? 

The update I installed was not through e-mail, my computer prompted me to update, and I did.  When I couldn't figure out what was wrong, I called dell.  That is when a tech told me it was the sp2 update.  I asked him what was wrong with it, he told me the update released from Microsoft was not compatible with all systems and it was causing lots of problems.  Since my warranty was up with dell, I would be charged a fee so I decided to try to fix it myself.  I went all over the web to find a fix.  I did try downloading all the things you say to download, but it didn't work.  I spent 2 weeks, every day downloading programs, running them and getting aggravated.  Tax time was almost here, I needed to fix my computer or borrow one. 

when I clicked on the link in the dr. watson error box, it led me to a temp. folder.  I went into safe mode and deleted the drwtsn.exe file.  This alone didn't work, it just reloaded.  So, I went into safe mode again:  This time I deleted the drwtsn.exe in the temp. folder and also went into add-remove programs and removed the sp2 update.  This time it worked.  Since it did work, I figured what the tech told me was true. 

If this is a trojan horse, why have I not had anymore problems with my computer? 

I have also updated from norton almost everyday since and ran scans but nothing comes up.  If you know about the dsnx-05, why is norton not finding it? 

I will in the near future visit microsoft and reload the sp2 update, but I was waiting until they figured out what was wrong.  As I said in many of my replies, you can go directly to microsoft and re-download the update.  I just choose not to at this time. 

I know that dr. watson is in the computer, in the registry because I found it.  I have seen others disable it from the registry.  Why would a drwtsn.exe file be in the internet temp. folder?  So, I never suggested to delete the dr. watson program, just the file in the temp. folder.  I have also seen someone try to re-format the entire computer-and get what I have seen called:  The blue screen of death. 

So, if the drwtsn.exe file has no business being in the temp. folder, and the real one is in the registry, what is the harm in deleting it?  Also,  If you remove the sp2 update, and go directly to microsoft and re-download another update, your computer is safe: (assuming it is not the update that is bad).  It only takes a minute or two to download another update.... So what is the harm in doing that?  If these 2 simple things work, with no other problems, I don't understand why not do it.  I spent 2 weeks with no results, and spent 20 minutes doing what I did and it worked.  So, if I have a trojan, how do I find it?  But, if I have no further problems, do I keep searching for it?  I will however re-download the sp2 update in the next week or two and see if I have the same problem.  But like I said, I did not update from an e-mail, and I am the only one that uses this computer, so that remains a mystery. 

Donna

Message Edited by ky331 on 04-12-2005 10:38 AM

Message Edited by ky331 on 04-12-2005 10:41 AM