Does a reference to HTREE in Bootlog.txt indicate a virus?

SUMMARY

Background information
Symantec Technical Support has received comments from several customers regarding the appearance of references to "HTREE" in the Windows 95/98/Me Bootlog.txt file. Various Web sites have messages posted to them on this subject as well.

In most cases, the customer has problems starting Windows. When they look at the Bootlog.txt file, they see text similar to the following:

[00130B42] Starting Unknown (HTREEROOT)
[00130B42] Started Unknown (HTREEROOT)
[00130B42] Enumerating Unknown (HTREEROOT)
[00130B42] Enumerated Unknown (HTREEROOT)

Many of the comments express concern indicating that Symantec antivirus products are "missing" a virus or other threat.

What is HTREE?
HTREE is a subkey that is found in the Windows registry. On Windows 95/98/Me computers, it is found at:

HKEY_Local_MachineENUMHTREE

The ENUM registry key contains the subkeys for hardware components used by your computer. Microsoft has reserved the HTREE subkey for future use.

When you start your Windows 95/98/Me computer, as part of the startup process, the file Bootlog.txt is created. If Windows starts normally, there will be eight lines that refer to HTREE:

[00130B42] Starting Unknown (HTREEROOT)
[00130B42] Started Unknown (HTREEROOT)
[00130B42] Enumerating Unknown (HTREEROOT)
[00130B42] Enumerated Unknown (HTREEROOT)
[00130B42] Starting Unknown (HTREERESERVED)
[00130B42] Started Unknown (HTREERESERVED)
[00130B42] Enumerating Unknown (HTREERESERVED)
[00130B42] Enumerated Unknown (HTREERESERVED)

If you are having a problem starting Windows, in many cases there will be four entries only for HTREE (the RESERVED entries will be missing):

[00130B42] Starting Unknown (HTREEROOT)
[00130B42] Started Unknown (HTREEROOT)
[00130B42] Enumerating Unknown (HTREEROOT)
[00130B42] Enumerated Unknown (HTREEROOT)

Are missing HTREE references an indication of a virus, worm, or Trojan?
No they are not. In most cases, missing references to HTREE are an indication of a hardware or software problem.

To be sure that a virus, worm, or Trojan has not caused this behavior, make sure that you have the most recent virus definitions, and then run a full system scan.

1. Updating the virus definitions
Symantec Security Response fully tests all the virus definitions for quality assurance before they are posted to our servers. There are two ways to obtain the most recent virus definitions:

• Running LiveUpdate, which is the easiest way to obtain the virus definitions. These virus definitions are posted to the LiveUpdate servers once each week (usually on Wednesdays), unless there is a major virus outbreak. To determine whether definitions for this threat are available by LiveUpdate, refer to the Virus Definitions (LiveUpdate), in the "Protection" section, at the top of this writeup.
• Downloading the definitions using the Intelligent Updater. The Intelligent Updater virus definitions are posted on U.S. business days (Monday through Friday). You should download the definitions from the Symantec Security Response Web site and manually install them. To determine whether definitions for this threat are available by the Intelligent Updater, refer to the Virus Definitions (Intelligent Updater), in the "Protection" section, at the top of this writeup.
  
  The Intelligent Updater virus definitions are available here. For detailed instructions on how to download and install the Intelligent Updater virus definitions from the Symantec Security Response Web site, click here.

2. Scanning the computer

1. Start your Symantec antivirus program and make sure that it is configured to scan all the files.
   • For Norton AntiVirus consumer products: Read the document, "How to configure Norton AntiVirus to scan all files."
   • For Symantec AntiVirus Enterprise products: Read the document, "How to verify that a Symantec Corporate antivirus product is set to scan All Files."
2. Run a full system scan.
3. If any files are detected as infected, click Repair. (The Repair option is not always available, and thus many files cannot be repaired.)
4. Delete or quarantine any files that cannot be repaired.