# Microsoft error reports/blue screen



## Goldfinger (Feb 19, 2006)

Hi

If possible, I'd like to work with CookieGal. 

I've been getting Microsoft error reports a lot lately. The files in question are from my temp folder even though when I go to look for them they arent there. 

I also got a blue screen when booting windows XP saying it stopped to protect damage from my computer than gave this:

0x0000000A (0x0000001c, 0x00000002, 0x00000001, 0x8053F86D)

It dumped my memory.

I thought it might be associated with my AV (AVG) so I just uninstalled it. I wish I could be more help, but its some intermittent problem. I'm concerned its gonna get worse.

HijackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:08:47 PM, on 4/24/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Cliff\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myfoxtampabay.com/myfox/...d=ABADCBC60E674D9A92384382D4056CE7?pageId=9.1
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareBlock Class - {0A87E45F-537A-40B4-B812-E2544C21A09F} - C:\Program Files\SpyCatcher 2006\SCActiveBlock.dll (file missing)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: RefresherBand Class - {B24BA06E-FB7B-4757-95C2-DC01125F750E} - C:\PROGRA~1\YREFRE~1\YREFRE~1.DLL
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AccuWeatherDesktopAlerts] C:\Program Files\AccuWeatherDesktopAlerts\AccuWeatherDesktopAlerts.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00C0A1F2-D492-4DBA-A8E2-76CB1B791724} (TNPLDownloader Control) - https://dtwx2.accuweather.com/tnpl_awda/client/download/TNPLDownloader.cab
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://supportcenter.rr.com/sdccommon/download/tgctlcm.cab
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {430DDE24-C051-11CF-95BE-0020AFF75E4F} (ichat xchat Control) - http://142.179.159.11:7080/chat/data/html/user/msie/msichat.ocx
O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} (TLIEFlashObj Class) - https://echat.us.dell.com/Media/VisitorChat/TLIEFlash.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SupportSoft RemoteAssist - SupportSoft, Inc. - C:\Program Files\Common Files\supportsoft\bin\ssrc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 7007 bytes


----------



## Goldfinger (Feb 19, 2006)

Bump!


----------



## Cookiegal (Aug 27, 2003)

Please visit *Combofix Guide & Instructions * for instructions for downloading and running ComboFix:

Post the log from ComboFix when you've accomplished that along with a new HijackThis log.

Important notes regarding ComboFix:

ComboFix may reset a number of Internet Explorer's settings, including making it the default browser. This can easily be changed once we're finished.

Combofix also prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you, please let me know. This can be undone manually when we're finished.


----------



## Goldfinger (Feb 19, 2006)

Hi Cookiegal, its good to be working with you again.

Since my original post, my machine has gotten worse. I would constantly get the blue screen saying it was shutting down windows and dumping my memory to protect from damage. I managed to boot up in safe mode. I lost all my saved settings including Internet Explorer, My Documents, outlook express and outlook emails (all email is gone), etc. Its as if I just bought the computer. The good news is my HD shows it has rougly the same used capacity as when my system was working. I can see my files by going through "My Computer" and than several folders. So I think all is still not lost at least.

Now to today. I downloaded Combofix. Followed its procedure including turning off my firewall, open windows, and Spyware blaster. I ran Combo fix and didnt touch anything. It got to "completed stage_8" and stopped. I dont hear any noises from computer indicating the program is still working. The clock is still working and the Windows screensaver has come on so i dont think its crashed. Its been over an half hour stuck there. I dont see anything in the combofix instructions on what to do if this happens. Should i close the program and try again? I'll wait to hear from you before proceeding....BTW, I'm on another computer so I can send you this.


----------



## Goldfinger (Feb 19, 2006)

You must've signed off, so I tried closing combofix but it wouldnt allow me so I shut everything off....After rebooting, I was able to run combofix. Heres the log:

ComboFix 08-04-29.3 - Cliff 2008-04-29 22:00:21.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.727 [GMT -4:00]
Running from: C:\Documents and Settings\Cliff.TIGER.000\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2008-03-28 to 2008-04-30 )))))))))))))))))))))))))))))))
.

2008-04-29 00:05 . 2008-04-29 00:05 d--------	C:\Documents and Settings\Cliff.TIGER.000\Application Data\Jasc Software Inc
2008-04-28 23:02 . 2004-10-27 19:54 d--------	C:\Documents and Settings\All Users
2008-04-28 22:19 . 2004-10-23 18:23 d--------	C:\Documents and Settings\Cliff.TIGER.000\Application Data\Sonic
2008-04-28 22:19 . 2008-04-29 00:05 d--h-----	C:\Documents and Settings\Cliff.TIGER.000\Application Data\Gtek
2008-04-28 22:19 . 2004-10-23 18:15 d--------	C:\Documents and Settings\Cliff.TIGER.000\Application Data\Creative
2008-04-28 22:19 . 2008-04-29 00:04 d--------	C:\Documents and Settings\Cliff.TIGER.000
2008-04-28 22:19 . 2008-04-29 22:04	110,592	--ah-----	C:\Documents and Settings\Cliff.TIGER.000\ntuser.dat.LOG
2008-04-28 22:09 . 2008-04-29 00:04 d--------	C:\Documents and Settings\Cliff.TIGER
2008-04-28 22:09 . 2008-04-29 18:28	1,024	--ah-----	C:\Documents and Settings\Cliff.TIGER\ntuser.dat.LOG
2008-04-28 00:08 . 2008-04-29 00:05 d--------	C:\Documents and Settings\All Users\Application Data\avg8
2008-04-20 13:22 . 1999-12-17 09:13	86,016	--a------	C:\WINDOWS\unvise32.exe
2008-03-24 01:13 . 2008-03-24 01:13 d--------	C:\Program Files\Common Files\xing shared
2008-03-21 00:37 . 2008-03-21 00:37 d--------	C:\Program Files\Common Files\supportsoft
2008-03-04 23:02 . 2008-03-04 23:37	3,420	--a------	C:\WINDOWS\SYSTEM32\tmp.reg
2008-03-04 23:01 . 2007-09-06 00:22	289,144	--a------	C:\WINDOWS\SYSTEM32\VCCLSID.exe
2008-03-04 23:01 . 2006-04-27 17:49	288,417	--a------	C:\WINDOWS\SYSTEM32\SrchSTS.exe
2008-03-04 23:01 . 2008-03-02 00:12	86,016	--a------	C:\WINDOWS\SYSTEM32\VACFix.exe
2008-03-04 23:01 . 2008-03-01 00:48	82,432	--a------	C:\WINDOWS\SYSTEM32\IEDFix.exe
2008-03-04 23:01 . 2003-06-05 21:13	53,248	--a------	C:\WINDOWS\SYSTEM32\Process.exe
2008-03-04 23:01 . 2004-07-31 18:50	51,200	--a------	C:\WINDOWS\SYSTEM32\dumphive.exe
2008-03-04 23:01 . 2007-10-04 00:36	25,600	--a------	C:\WINDOWS\SYSTEM32\WS2Fix.exe
2008-03-02 22:38 . 2008-04-28 00:04 d--------	C:\Program Files\SpywareBlaster
2008-03-02 22:38 . 2008-04-29 18:17 d-a------	C:\Documents and Settings\All Users\Application Data\TEMP

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-29 04:25	---------	d-----w	C:\Program Files\Lavasoft
2008-04-29 02:07	---------	d-----w	C:\Program Files\ZipCentral
2008-04-24 23:02	---------	d-----w	C:\Documents and Settings\All Users\Application Data\Grisoft
2008-04-20 17:31	---------	d-----w	C:\Program Files\PanzerElite
2008-04-08 00:17	---------	d-----w	C:\Program Files\SpeedFan
2008-03-24 05:13	348,160	----a-w	C:\WINDOWS\SYSTEM32\msvcr71.dll
2008-03-24 05:13	---------	d-----w	C:\Program Files\Common Files\Real
2008-03-23 04:45	---------	d-----w	C:\Program Files\Common Files\Adobe
2008-03-20 16:41	---------	d-----w	C:\Program Files\LimeWire
2008-03-19 09:47	1,845,248	----a-w	C:\WINDOWS\SYSTEM32\win32k.sys
2008-03-19 09:47	1,845,248	------w	C:\WINDOWS\SYSTEM32\DLLCACHE\win32k.sys
2008-03-08 04:11	---------	d-----w	C:\Program Files\Java
2008-03-07 00:40	---------	d-----w	C:\Program Files\ewido anti-malware
2008-03-02 06:11	---------	d-----w	C:\Program Files\WxEx Installer
2008-03-01 22:36	3,591,680	----a-w	C:\WINDOWS\SYSTEM32\DLLCACHE\mshtml.dll
2008-02-29 08:55	70,656	------w	C:\WINDOWS\SYSTEM32\DLLCACHE\ie4uinit.exe
2008-02-29 08:55	625,664	------w	C:\WINDOWS\SYSTEM32\DLLCACHE\iexplore.exe
2008-02-22 10:00	13,824	------w	C:\WINDOWS\SYSTEM32\DLLCACHE\ieudinit.exe
2008-02-20 06:51	282,624	----a-w	C:\WINDOWS\SYSTEM32\gdi32.dll
2008-02-20 06:51	282,624	------w	C:\WINDOWS\SYSTEM32\DLLCACHE\gdi32.dll
2008-02-20 05:32	45,568	----a-w	C:\WINDOWS\SYSTEM32\dnsrslvr.dll
2008-02-20 05:32	45,568	------w	C:\WINDOWS\SYSTEM32\DLLCACHE\dnsrslvr.dll
2008-02-20 05:32	148,992	------w	C:\WINDOWS\SYSTEM32\DLLCACHE\dnsapi.dll
2008-02-15 05:44	161,792	------w	C:\WINDOWS\SYSTEM32\DLLCACHE\ieakui.dll
2005-05-24 17:06	72	----a-w	C:\Program Files\UNWISE.INI
2005-05-24 17:06	17,256	----a-w	C:\Program Files\INSTALL.LOG
1999-06-25 14:55	149,504	----a-w	C:\Program Files\UNWISE.EXE
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="C:\Program Files\Dell Support\DSAgnt.exe" [2004-07-19 08:51 306688]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 02:00 90112]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 02:01 110592]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-11-09 00:51 98304]
"P17Helper"="P17.dll" [2004-06-10 12:51 60928 C:\WINDOWS\SYSTEM32\P17.dll]
"IntelMeM"="C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-03 21:12 221184]
"DXDllRegExe"="dxdllreg.exe" []
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-08-23 19:19 57344]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-08-13 02:05 122939]
"CTSysVol"="C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe" [2003-09-17 11:43 57344]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 12:52 339968]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-03-24 01:13 185896]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SpyCatcher Protector.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SpyCatcher Protector.lnk
backup=C:\WINDOWS\pss\SpyCatcher Protector.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
--a------ 2004-08-25 12:52 339968 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_EMC]
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\gcasServ]
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
--a------ 2003-12-22 08:38 241664 C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2003-08-04 17:28 49152 C:\Program Files\HP\HP Software Update\HPWuSchd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ Lite]
--a------ 2006-07-11 06:06 3144800 C:\Program Files\ICQLite\ICQLite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot]
--a------ 2006-01-19 11:06 11776 C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mmtask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
--a------ 2006-01-19 11:06 110592 C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-01-19 12:54 5674352 C:\Program Files\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
--------- 2004-04-11 21:15 290816 C:\Program Files\Dell\Media Experience\PCMService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector]
--a------ 2005-10-28 14:08 335872 C:\Program Files\Picasa2\PicasaMediaDetector.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
C:\Program Files\Steam\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2005-11-10 14:03 36975 C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 2006-10-24 17:10 4662776 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\WINDOWS\\SYSTEM32\\MSHTA.EXE"=
"C:\\Program Files\\ICQLite\\ICQLite.exe"=
"C:\\Program Files\\Messenger\\MSMSGS.EXE"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"C:\\Program Files\\EA Games\\Command and Conquer Generals\\patchget.dat"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"13017:TCP"= 13017:TCP:*isabled:limewire
"13017:UDP"= 13017:UDP:*isabled:limewire
"6346:TCP"= 6346:TCP:*isabled:Limewire
"6346:UDP"= 6346:UDP:*isabled:Limewire

R1 papycpu;papycpu;C:\WINDOWS\system32\drivers\papycpu.sys [1998-10-06 10:36]
S3 SupportSoft RemoteAssist;SupportSoft RemoteAssist;C:\Program Files\Common Files\supportsoft\bin\ssrc.exe [2007-12-11 04:39]

.
Contents of the 'Scheduled Tasks' folder
"2008-04-30 02:02:32 C:\WINDOWS\Tasks\User_Feed_Synchronization-{DF7F15DF-DCC2-412F-8AAE-96261228DD67}.job"
- C:\WINDOWS\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-29 22:04:15
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-04-29 22:05:24
ComboFix-quarantined-files.txt 2008-04-30 02:05:22
ComboFix2.txt 2008-03-06 19:43:14

Pre-Run: 84,462,821,376 bytes free
Post-Run: 84,936,925,184 bytes free

178	--- E O F ---	2008-04-23 15:45:31

Heres the latest Hijackthis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:11:00 PM, on 4/29/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\Cliff.TIGER.000\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareBlock Class - {0A87E45F-537A-40B4-B812-E2544C21A09F} - C:\Program Files\SpyCatcher 2006\SCActiveBlock.dll (file missing)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: RefresherBand Class - {B24BA06E-FB7B-4757-95C2-DC01125F750E} - C:\PROGRA~1\YREFRE~1\YREFRE~1.DLL
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00C0A1F2-D492-4DBA-A8E2-76CB1B791724} (TNPLDownloader Control) - https://dtwx2.accuweather.com/tnpl_awda/client/download/TNPLDownloader.cab
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://supportcenter.rr.com/sdccommon/download/tgctlcm.cab
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {430DDE24-C051-11CF-95BE-0020AFF75E4F} (ichat xchat Control) - http://142.179.159.11:7080/chat/data/html/user/msie/msichat.ocx
O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} (TLIEFlashObj Class) - https://echat.us.dell.com/Media/VisitorChat/TLIEFlash.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SupportSoft RemoteAssist - SupportSoft, Inc. - C:\Program Files\Common Files\supportsoft\bin\ssrc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 6978 bytes


----------



## Cookiegal (Aug 27, 2003)

That's the log after the fourth run of ComboFix. I would like to see the log from the first run so I can see if it actually removed anything please.


----------



## Goldfinger (Feb 19, 2006)

Hmm, Combofix only completed one run as far as I know. As mentioned on 1st run it stopped after part way through ( I left it open for over an hour to make sure it had stopped rather than just having a hard time finishing). I had to reboot and start over. Perhaps it removed something even though it never finish? I tried running it in safe mode after that thinking it would help finish, but as soon as starting the blue screen came up saying windows was being shut down to prevent damage and was dumping the memory. I did that at least twice with same result. Maybe thats the 2nd and 3rd time?

In C:\ComboFix.txt, this is only log I have. Sorry if I screwed things up. I didnt know what else to do after it stopped working the 1st time. 

Is there any other place the log could be? Does it overwrite previous logs? Again, sorry.

ComboFix 08-04-29.3 - Cliff 2008-04-29 22:00:21.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.727 [GMT -4:00]
Running from: C:\Documents and Settings\Cliff.TIGER.000\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2008-03-28 to 2008-04-30 )))))))))))))))))))))))))))))))
.

2008-04-29 00:05 . 2008-04-29 00:05 d--------	C:\Documents and Settings\Cliff.TIGER.000\Application Data\Jasc Software Inc
2008-04-28 23:02 . 2004-10-27 19:54 d--------	C:\Documents and Settings\All Users
2008-04-28 22:19 . 2004-10-23 18:23 d--------	C:\Documents and Settings\Cliff.TIGER.000\Application Data\Sonic
2008-04-28 22:19 . 2008-04-29 00:05 d--h-----	C:\Documents and Settings\Cliff.TIGER.000\Application Data\Gtek
2008-04-28 22:19 . 2004-10-23 18:15 d--------	C:\Documents and Settings\Cliff.TIGER.000\Application Data\Creative
2008-04-28 22:19 . 2008-04-29 00:04 d--------	C:\Documents and Settings\Cliff.TIGER.000
2008-04-28 22:19 . 2008-04-29 22:04	110,592	--ah-----	C:\Documents and Settings\Cliff.TIGER.000\ntuser.dat.LOG
2008-04-28 22:09 . 2008-04-29 00:04 d--------	C:\Documents and Settings\Cliff.TIGER
2008-04-28 22:09 . 2008-04-29 18:28	1,024	--ah-----	C:\Documents and Settings\Cliff.TIGER\ntuser.dat.LOG
2008-04-28 00:08 . 2008-04-29 00:05 d--------	C:\Documents and Settings\All Users\Application Data\avg8
2008-04-20 13:22 . 1999-12-17 09:13	86,016	--a------	C:\WINDOWS\unvise32.exe
2008-03-24 01:13 . 2008-03-24 01:13 d--------	C:\Program Files\Common Files\xing shared
2008-03-21 00:37 . 2008-03-21 00:37 d--------	C:\Program Files\Common Files\supportsoft
2008-03-04 23:02 . 2008-03-04 23:37	3,420	--a------	C:\WINDOWS\SYSTEM32\tmp.reg
2008-03-04 23:01 . 2007-09-06 00:22	289,144	--a------	C:\WINDOWS\SYSTEM32\VCCLSID.exe
2008-03-04 23:01 . 2006-04-27 17:49	288,417	--a------	C:\WINDOWS\SYSTEM32\SrchSTS.exe
2008-03-04 23:01 . 2008-03-02 00:12	86,016	--a------	C:\WINDOWS\SYSTEM32\VACFix.exe
2008-03-04 23:01 . 2008-03-01 00:48	82,432	--a------	C:\WINDOWS\SYSTEM32\IEDFix.exe
2008-03-04 23:01 . 2003-06-05 21:13	53,248	--a------	C:\WINDOWS\SYSTEM32\Process.exe
2008-03-04 23:01 . 2004-07-31 18:50	51,200	--a------	C:\WINDOWS\SYSTEM32\dumphive.exe
2008-03-04 23:01 . 2007-10-04 00:36	25,600	--a------	C:\WINDOWS\SYSTEM32\WS2Fix.exe
2008-03-02 22:38 . 2008-04-28 00:04 d--------	C:\Program Files\SpywareBlaster
2008-03-02 22:38 . 2008-04-29 18:17 d-a------	C:\Documents and Settings\All Users\Application Data\TEMP

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-29 04:25	---------	d-----w	C:\Program Files\Lavasoft
2008-04-29 02:07	---------	d-----w	C:\Program Files\ZipCentral
2008-04-24 23:02	---------	d-----w	C:\Documents and Settings\All Users\Application Data\Grisoft
2008-04-20 17:31	---------	d-----w	C:\Program Files\PanzerElite
2008-04-08 00:17	---------	d-----w	C:\Program Files\SpeedFan
2008-03-24 05:13	348,160	----a-w	C:\WINDOWS\SYSTEM32\msvcr71.dll
2008-03-24 05:13	---------	d-----w	C:\Program Files\Common Files\Real
2008-03-23 04:45	---------	d-----w	C:\Program Files\Common Files\Adobe
2008-03-20 16:41	---------	d-----w	C:\Program Files\LimeWire
2008-03-19 09:47	1,845,248	----a-w	C:\WINDOWS\SYSTEM32\win32k.sys
2008-03-19 09:47	1,845,248	------w	C:\WINDOWS\SYSTEM32\DLLCACHE\win32k.sys
2008-03-08 04:11	---------	d-----w	C:\Program Files\Java
2008-03-07 00:40	---------	d-----w	C:\Program Files\ewido anti-malware
2008-03-02 06:11	---------	d-----w	C:\Program Files\WxEx Installer
2008-03-01 22:36	3,591,680	----a-w	C:\WINDOWS\SYSTEM32\DLLCACHE\mshtml.dll
2008-02-29 08:55	70,656	------w	C:\WINDOWS\SYSTEM32\DLLCACHE\ie4uinit.exe
2008-02-29 08:55	625,664	------w	C:\WINDOWS\SYSTEM32\DLLCACHE\iexplore.exe
2008-02-22 10:00	13,824	------w	C:\WINDOWS\SYSTEM32\DLLCACHE\ieudinit.exe
2008-02-20 06:51	282,624	----a-w	C:\WINDOWS\SYSTEM32\gdi32.dll
2008-02-20 06:51	282,624	------w	C:\WINDOWS\SYSTEM32\DLLCACHE\gdi32.dll
2008-02-20 05:32	45,568	----a-w	C:\WINDOWS\SYSTEM32\dnsrslvr.dll
2008-02-20 05:32	45,568	------w	C:\WINDOWS\SYSTEM32\DLLCACHE\dnsrslvr.dll
2008-02-20 05:32	148,992	------w	C:\WINDOWS\SYSTEM32\DLLCACHE\dnsapi.dll
2008-02-15 05:44	161,792	------w	C:\WINDOWS\SYSTEM32\DLLCACHE\ieakui.dll
2005-05-24 17:06	72	----a-w	C:\Program Files\UNWISE.INI
2005-05-24 17:06	17,256	----a-w	C:\Program Files\INSTALL.LOG
1999-06-25 14:55	149,504	----a-w	C:\Program Files\UNWISE.EXE
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="C:\Program Files\Dell Support\DSAgnt.exe" [2004-07-19 08:51 306688]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 02:00 90112]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 02:01 110592]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-11-09 00:51 98304]
"P17Helper"="P17.dll" [2004-06-10 12:51 60928 C:\WINDOWS\SYSTEM32\P17.dll]
"IntelMeM"="C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-03 21:12 221184]
"DXDllRegExe"="dxdllreg.exe" []
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-08-23 19:19 57344]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-08-13 02:05 122939]
"CTSysVol"="C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe" [2003-09-17 11:43 57344]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 12:52 339968]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-03-24 01:13 185896]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SpyCatcher Protector.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SpyCatcher Protector.lnk
backup=C:\WINDOWS\pss\SpyCatcher Protector.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
--a------ 2004-08-25 12:52 339968 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_EMC]
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\gcasServ]
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
--a------ 2003-12-22 08:38 241664 C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2003-08-04 17:28 49152 C:\Program Files\HP\HP Software Update\HPWuSchd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ Lite]
--a------ 2006-07-11 06:06 3144800 C:\Program Files\ICQLite\ICQLite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot]
--a------ 2006-01-19 11:06 11776 C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mmtask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
--a------ 2006-01-19 11:06 110592 C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-01-19 12:54 5674352 C:\Program Files\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
--------- 2004-04-11 21:15 290816 C:\Program Files\Dell\Media Experience\PCMService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector]
--a------ 2005-10-28 14:08 335872 C:\Program Files\Picasa2\PicasaMediaDetector.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
C:\Program Files\Steam\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2005-11-10 14:03 36975 C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 2006-10-24 17:10 4662776 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\WINDOWS\\SYSTEM32\\MSHTA.EXE"=
"C:\\Program Files\\ICQLite\\ICQLite.exe"=
"C:\\Program Files\\Messenger\\MSMSGS.EXE"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"C:\\Program Files\\EA Games\\Command and Conquer Generals\\patchget.dat"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"13017:TCP"= 13017:TCP:*isabled:limewire
"13017:UDP"= 13017:UDP:*isabled:limewire
"6346:TCP"= 6346:TCP:*isabled:Limewire
"6346:UDP"= 6346:UDP:*isabled:Limewire

R1 papycpu;papycpu;C:\WINDOWS\system32\drivers\papycpu.sys [1998-10-06 10:36]
S3 SupportSoft RemoteAssist;SupportSoft RemoteAssist;C:\Program Files\Common Files\supportsoft\bin\ssrc.exe [2007-12-11 04:39]

.
Contents of the 'Scheduled Tasks' folder
"2008-04-30 02:02:32 C:\WINDOWS\Tasks\User_Feed_Synchronization-{DF7F15DF-DCC2-412F-8AAE-96261228DD67}.job"
- C:\WINDOWS\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-29 22:04:15
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-04-29 22:05:24
ComboFix-quarantined-files.txt 2008-04-30 02:05:22
ComboFix2.txt 2008-03-06 19:43:14

Pre-Run: 84,462,821,376 bytes free
Post-Run: 84,936,925,184 bytes free

178	--- E O F ---	2008-04-23 15:45:31


----------



## Cookiegal (Aug 27, 2003)

Please go to *Start *- *Run *- type in *eventvwr.msc* to open the event viewer. Look under both "Application" and "System" for recent (the last 48 hours or so) errors (shown in red) and if found, do this for each one.

Double-click the error to open it up and then click on the icon that looks like two pieces of paper. This will copy the full error. Then "paste" the error into Notepad. Do this for each one until you have them all listed in Notepad and then copy and paste the list in a reply here please.


----------



## Goldfinger (Feb 19, 2006)

Wow lots of errors logged! A few Applications and MANY systems. Most of the system errors are the same with same exact date. I'm worn out  If you want me to go back farther let me know. I added the dashed lines to help seperate all of them.

I broke it up into parts so it all would fit her.

Application Errors:

Event Type:	Error
Event Source:	Application Error
Event Category:	None
Event ID:	1000
Date: 4/29/2008
Time: 12:27:43 AM
User: N/A
Computer:	TIGER
Description:
Faulting application iexplore.exe, version 7.0.6000.16640, faulting module urlmon.dll, version 7.0.6000.16640, fault address 0x00003d95.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 69 65 78 ure iex
0018: 70 6c 6f 72 65 2e 65 78 plore.ex
0020: 65 20 37 2e 30 2e 36 30 e 7.0.60
0028: 30 30 2e 31 36 36 34 30 00.16640
0030: 20 69 6e 20 75 72 6c 6d in urlm
0038: 6f 6e 2e 64 6c 6c 20 37 on.dll 7
0040: 2e 30 2e 36 30 30 30 2e .0.6000.
0048: 31 36 36 34 30 20 61 74 16640 at
0050: 20 6f 66 66 73 65 74 20 offset 
0058: 30 30 30 30 33 64 39 35 00003d95
0060: 0d 0a ..

-----------------------------------------------

Event Type:	Error
Event Source:	EventSystem
Event Category:	(50)
Event ID:	4609
Date: 4/29/2008
Time: 12:41:56 AM
User: N/A
Computer:	TIGER
Description:
The COM+ Event System detected a bad return code during its internal processing. HRESULT was 8007043C from line 44 of d:\qxp_slp\com\com1x\src\events\tier1\eventsystemobj.cpp. Please contact Microsoft Product Support Services to report this error.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-----------------------------------------------

Event Type:	Error
Event Source:	Application Error
Event Category:	None
Event ID:	1000
Date: 4/29/2008
Time: 9:42:11 PM
User: N/A
Computer:	TIGER
Description:
Faulting application iexplore.exe, version 7.0.6000.16640, faulting module unknown, version 0.0.0.0, fault address 0x83699785.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 69 65 78 ure iex
0018: 70 6c 6f 72 65 2e 65 78 plore.ex
0020: 65 20 37 2e 30 2e 36 30 e 7.0.60
0028: 30 30 2e 31 36 36 34 30 00.16640
0030: 20 69 6e 20 75 6e 6b 6e in unkn
0038: 6f 77 6e 20 30 2e 30 2e own 0.0.
0040: 30 2e 30 20 61 74 20 6f 0.0 at o
0048: 66 66 73 65 74 20 38 33 ffset 83
0050: 36 39 39 37 38 35 0d 0a 699785..

------------------------------------------------

Event Type:	Error
Event Source:	Application Error
Event Category:	(100)
Event ID:	1000
Date: 4/29/2008
Time: 9:57:55 PM
User: N/A
Computer:	TIGER
Description:
Faulting application FXSSVC.EXE, version 5.2.2600.2180, faulting module NTDLL.DLL, version 5.1.2600.2180, fault address 0x00010f29.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 46 58 53 ure FXS
0018: 53 56 43 2e 45 58 45 20 SVC.EXE 
0020: 35 2e 32 2e 32 36 30 30 5.2.2600
0028: 2e 32 31 38 30 20 69 6e .2180 in
0030: 20 4e 54 44 4c 4c 2e 44 NTDLL.D
0038: 4c 4c 20 35 2e 31 2e 32 LL 5.1.2
0040: 36 30 30 2e 32 31 38 30 600.2180
0048: 20 61 74 20 6f 66 66 73 at offs
0050: 65 74 20 30 30 30 31 30 et 00010
0058: 66 32 39 f29

---------------------------------------------

SYSTEM ERRORS:

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10005
Date: 4/29/2008
Time: 12:09:38 AM
User: NT AUTHORITY\SYSTEM
Computer:	TIGER
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service EventSystem with arguments "" in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

--------------------------------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7031
Date: 4/29/2008
Time: 12:09:44 AM
User: N/A
Computer:	TIGER
Description:
The Ad-Aware 2007 Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------------------------------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7026
Date: 4/29/2008
Time: 12:09:44 AM
User: N/A
Computer:	TIGER
Description:
The following boot-start or system-start driver(s) failed to load: 
Fips
intelppm
prodrv06

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

--------------------------------------------

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10005
Date: 4/29/2008
Time: 12:10:28 AM
User: TIGER\Cliff
Computer:	TIGER
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service wuauserv with arguments "" in order to run the server:
{E60687F7-01A1-40AA-86AC-DB1CBF673334}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------------------------------------------

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10005
Date: 4/29/2008
Time: 12:13:15 AM
User: TIGER\Cliff
Computer:	TIGER
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service MSIServer with arguments "" in order to run the server:
{000C101C-0000-0000-C000-000000000046}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------------------------------------------

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10005
Date: 4/29/2008
Time: 12:13:15 AM
User: TIGER\Cliff
Computer:	TIGER
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service MSIServer with arguments "" in order to run the server:
{000C101C-0000-0000-C000-000000000046}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------------------------------------------

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10005
Date: 4/29/2008
Time: 12:13:37 AM
User: TIGER\Cliff
Computer:	TIGER
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service MSIServer with arguments "" in order to run the server:
{000C101C-0000-0000-C000-000000000046}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------------------------------------

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10005
Date: 4/29/2008
Time: 12:13:37 AM
User: TIGER\Cliff
Computer:	TIGER
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service MSIServer with arguments "" in order to run the server:
{000C101C-0000-0000-C000-000000000046}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------------------------------------

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10005
Date: 4/29/2008
Time: 12:14:54 AM
User: TIGER\Cliff
Computer:	TIGER
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service MSIServer with arguments "" in order to run the server:
{000C101C-0000-0000-C000-000000000046}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------------------------------------

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10005
Date: 4/29/2008
Time: 12:21:25 AM
User: TIGER\Cliff
Computer:	TIGER
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service wuauserv with arguments "" in order to run the server:
{E60687F7-01A1-40AA-86AC-DB1CBF673334}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

--------------------------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:40 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------------------------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:40 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------------------------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:40 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

--------------------------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:40 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-----------------------------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:40 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------------------------------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:40 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------------------------------------------

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10005
Date: 4/29/2008
Time: 12:21:40 AM
User: TIGER\Cliff
Computer:	TIGER
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service MSIServer with arguments "" in order to run the server:
{000C101C-0000-0000-C000-000000000046}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

//////////////


----------



## Goldfinger (Feb 19, 2006)

Continued....

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:41 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:41 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:41 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-----------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:41 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

--------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:41 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:41 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:41 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:41 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:41 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:42 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:42 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:42 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

--------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:42 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:42 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:42 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:42 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-----------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:42 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

--------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:42 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:43 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:43 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:43 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

--------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:43 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:43 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:43 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:43 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-----------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:43 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:43 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-----------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:44 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:44 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

--------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:44 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:44 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:44 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:44 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-----------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:44 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:44 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

--------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:44 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:45 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:45 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:45 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:45 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

--------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:45 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------------
Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:45 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:45 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:45 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:45 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:45 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:45 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:46 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:46 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:46 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:46 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

--------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:46 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

--------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:46 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:46 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-----------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:46 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:46 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------


----------



## Goldfinger (Feb 19, 2006)

Continued 2.....

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:47 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:47 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:47 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:47 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:47 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:47 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:47 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:47 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:47 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:48 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:48 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:48 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-----------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:48 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:48 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-----------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:48 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:48 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

--------------

Event Type:	Information
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7036
Date: 4/29/2008
Time: 12:21:48 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service entered the stopped state.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:48 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-----------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:48 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:49 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:49 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:49 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:49 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

--------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:49 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

--------------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:49 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:49 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

--------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:49 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:49 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:50 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-----------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:50 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:50 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:50 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:50 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:50 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:50 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:50 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:51 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

--------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:51 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

--------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:51 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:21:51 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

--------------------------------------------

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10005
Date: 4/29/2008
Time: 12:22:05 AM
User: TIGER\Cliff
Computer:	TIGER
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service MSIServer with arguments "" in order to run the server:
{000C101C-0000-0000-C000-000000000046}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

--------------------------------------------------

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10005
Date: 4/29/2008
Time: 12:22:22 AM
User: NT AUTHORITY\SYSTEM
Computer:	TIGER
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service EventSystem with arguments "" in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------------------------------------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:34 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------------------------------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:34 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------------------------------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:34 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-----------------------------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:34 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-----------------------------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:34 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------------------------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:34 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------------------------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:34 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------------------------------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:34 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

--------------------------------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:34 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


----------



## Goldfinger (Feb 19, 2006)

continued 3......

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:35 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

--------------------------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:35 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------------------------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:35 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------------------------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:35 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------------------------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:35 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

--------------------------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:35 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

--------------------------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:35 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

--------------------------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:35 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-----------------------------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:35 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------------------------------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:35 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------------------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:36 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-----------------------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:36 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------------------------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:36 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-----------------------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:36 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:36 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:36 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

--------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:36 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:36 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-----------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:36 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-----------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:37 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:37 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:37 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:37 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:37 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:37 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-----------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:37 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-----------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:37 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:37 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:38 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-----------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:38 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:38 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

--------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:38 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

--------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:38 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:38 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-----------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:38 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:38 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

--------------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:38 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-----------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:39 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

--------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:39 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:39 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:39 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:39 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:39 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:39 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:39 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:39 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

--------


----------



## Goldfinger (Feb 19, 2006)

continued 4....This is last of it.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:40 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:40 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:40 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:40 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:40 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:40 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:40 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:40 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:40 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:41 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:41 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:41 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:41 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-----------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:41 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:41 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:41 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:41 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:41 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:41 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:42 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:42 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:42 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:42 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-----------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:42 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

--------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:42 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:42 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-----

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:42 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:42 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:43 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

--------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:43 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:43 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

--------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:43 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:43 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:43 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:43 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:43 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:43 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:44 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:44 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-----

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:44 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-----

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:44 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:44 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:44 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-----

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:44 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-----

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:44 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:44 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-----

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7023
Date: 4/29/2008
Time: 12:25:45 AM
User: N/A
Computer:	TIGER
Description:
The Application Management service terminated with the following error: 
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-----

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10005
Date: 4/29/2008
Time: 12:27:22 AM
User: NT AUTHORITY\SYSTEM
Computer:	TIGER
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service EventSystem with arguments "" in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7026
Date: 4/29/2008
Time: 12:28:28 AM
User: N/A
Computer:	TIGER
Description:
The following boot-start or system-start driver(s) failed to load: 
Fips
intelppm
prodrv06

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------
Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10005
Date: 4/29/2008
Time: 12:32:35 AM
User: TIGER\Cliff
Computer:	TIGER
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service StiSvc with arguments "" in order to run the server:
{A1F4E726-8CF1-11D1-BF92-0060081ED811}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10005
Date: 4/29/2008
Time: 12:32:44 AM
User: TIGER\Cliff
Computer:	TIGER
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service StiSvc with arguments "" in order to run the server:
{A1F4E726-8CF1-11D1-BF92-0060081ED811}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10005
Date: 4/29/2008
Time: 12:37:14 AM
User: TIGER\Cliff
Computer:	TIGER
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service StiSvc with arguments "" in order to run the server:
{A1F4E726-8CF1-11D1-BF92-0060081ED811}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10005
Date: 4/29/2008
Time: 12:41:56 AM
User: TIGER\Cliff
Computer:	TIGER
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service EventSystem with arguments "" in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10005
Date: 4/29/2008
Time: 12:44:53 AM
User: NT AUTHORITY\SYSTEM
Computer:	TIGER
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service EventSystem with arguments "" in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------

Event Type:	Error
Event Source:	Dhcp
Event Category:	None
Event ID:	1002
Date: 4/29/2008
Time: 1:07:59 PM
User: N/A
Computer:	TIGER
Description:
The IP address lease 192.168.2.2 for the Network Card with network address 001111439534 has been denied by the DHCP server 192.168.2.1 (The DHCP Server sent a DHCPNACK message).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10005
Date: 4/29/2008
Time: 1:08:46 PM
User: NT AUTHORITY\SYSTEM
Computer:	TIGER
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service EventSystem with arguments "" in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7026
Date: 4/29/2008
Time: 1:09:42 PM
User: N/A
Computer:	TIGER
Description:
The following boot-start or system-start driver(s) failed to load: 
Fips
intelppm
prodrv06

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-----

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10005
Date: 4/29/2008
Time: 1:15:01 PM
User: NT AUTHORITY\SYSTEM
Computer:	TIGER
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service EventSystem with arguments "" in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10005
Date: 4/29/2008
Time: 9:23:36 PM
User: NT AUTHORITY\SYSTEM
Computer:	TIGER
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service EventSystem with arguments "" in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-----------

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10005
Date: 4/29/2008
Time: 9:40:11 PM
User: NT AUTHORITY\SYSTEM
Computer:	TIGER
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service EventSystem with arguments "" in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7026
Date: 4/29/2008
Time: 9:41:15 PM
User: N/A
Computer:	TIGER
Description:
The following boot-start or system-start driver(s) failed to load: 
Fips
intelppm
prodrv06

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------

Event Type:	Error
Event Source:	System Error
Event Category:	(102)
Event ID:	1003
Date: 4/29/2008
Time: 9:57:56 PM
User: N/A
Computer:	TIGER
Description:
Error code 10000050, parameter1 e22ba4ec, parameter2 00000001, parameter3 f7313795, parameter4 00000001.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 53 79 73 74 65 6d 20 45 System E
0008: 72 72 6f 72 20 20 45 72 rror Er
0010: 72 6f 72 20 63 6f 64 65 ror code
0018: 20 31 30 30 30 30 30 35 1000005
0020: 30 20 20 50 61 72 61 6d 0 Param
0028: 65 74 65 72 73 20 65 32 eters e2
0030: 32 62 61 34 65 63 2c 20 2ba4ec, 
0038: 30 30 30 30 30 30 30 31 00000001
0040: 2c 20 66 37 33 31 33 37 , f73137
0048: 39 35 2c 20 30 30 30 30 95, 0000
0050: 30 30 30 31 0001

----------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7022
Date: 4/29/2008
Time: 10:00:13 PM
User: N/A
Computer:	TIGER
Description:
The Fax service hung on starting.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

--------

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7034
Date: 4/29/2008
Time: 10:00:25 PM
User: N/A
Computer:	TIGER
Description:
The Fax service terminated unexpectedly. It has done this 1 time(s).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

------------

Event Type:	Error
Event Source:	Dhcp
Event Category:	None
Event ID:	1002
Date: 4/30/2008
Time: 12:04:08 PM
User: N/A
Computer:	TIGER
Description:
The IP address lease 192.168.2.2 for the Network Card with network address 001111439534 has been denied by the DHCP server 192.168.2.1 (The DHCP Server sent a DHCPNACK message).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

-----------


----------



## Cookiegal (Aug 27, 2003)

Click Start and My Computer. Right-click the hard drive you want to check, and click Properties. Select the Tools tab and click Check Now. Check both boxes. Click Start. You'll get a message that the computer must be rebooted to run a complete check. Click Yes and reboot. Chkdsk will take awhile, so run it when you don't need to use the computer for something else.

Then, after the run is finished, go to *Start *- *Run *and type in *eventvwr.msc*, and hit enter.
When Event Viewer opens, click on "Application", then scroll
down to "Winlogon" and double-click on it to open it up. This is the log
created after running chkdsk. Click on the icon that looks like two pieces of paper to copy it and then paste it here please.


----------



## Goldfinger (Feb 19, 2006)

Scan disk complete:

Event Type:	Information
Event Source:	Winlogon
Event Category:	None
Event ID:	1001
Date: 4/30/2008
Time: 8:39:38 PM
User: N/A
Computer:	TIGER
Description:
Checking file system on C:
The type of the file system is NTFS.
Cleaning up 96 unused index entries from index $SII of file 0x9.
Cleaning up 96 unused index entries from index $SDH of file 0x9.
Cleaning up 96 unused security descriptors.
CHKDSK is verifying Usn Journal...
The USN Journal entry at offset 0x28aacc780 and length 0x4058 crosses
the page boundary.
The USN Journal entry at offset 0x28aae0170 in file 0x1b835 is not
consistence. The entry has length of 0x60 and a file name length of 0x220.
60 00 00 00 02 00 00 00 9b e6 01 00 00 00 09 00 `...............
9b e3 01 00 00 00 45 00 70 01 ae 8a 02 00 00 00 ......E.p.......
ba 68 d8 6d a5 a9 c8 01 07 00 00 00 00 00 00 00 .h.m............
b8 03 00 00 20 00 00 00 20 02 3c 00 41 00 64 00 .... ... .<.A.d.
64 00 72 00 65 00 73 00 73 00 20 00 42 00 6f 00 d.r.e.s.s. .B.o.
6f 00 6b 00 2e 00 6c 00 6e 00 6b 00 00 00 00 00 o.k...l.n.k.....
60 00 00 00 02 00 00 00 9b e6 01 00 00 00 09 00 `...............
The USN Journal entry at offset 0x28b3278b0 in file 0x1b835 is not
consistence. The entry has length of 0x50 and a file name length of 0x4012.
50 00 00 00 02 00 00 00 c0 f6 01 00 00 00 27 00 P.............'.
16 0a 00 00 00 00 8f 0a b0 78 32 8b 02 00 00 00 .........x2.....
9a eb 9a 14 47 aa c8 01 00 01 00 00 00 00 00 00 ....G...........
a6 01 00 00 20 00 00 00 12 40 3c 00 53 00 50 00 .... [email protected]<.S.P.
4c 00 31 00 38 00 2e 00 74 00 6d 00 70 00 00 00 L.1.8...t.m.p...
50 00 00 00 02 00 00 00 c0 f6 01 00 00 00 27 00 P.............'.
Repairing Usn Journal file record segment.
Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
Windows replaced bad clusters in file 105173
of name \SYSTEM~1\_RESTO~1\RP48\snapshot\_R017D~1.
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
Free space verification is complete.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows has made corrections to the file system.

152553239 KB total disk space.
69221120 KB in 124268 files.
42272 KB in 8301 indexes.
0 KB in bad sectors.
323063 KB in use by the system.
65536 KB occupied by the log file.
82966784 KB available on disk.

4096 bytes in each allocation unit.
38138309 total allocation units on disk.
20741696 allocation units available on disk.

Internal Info:
50 46 02 00 e4 05 02 00 2a ee 02 00 00 00 00 00 PF......*.......
a6 14 00 00 00 00 00 00 20 04 00 00 00 00 00 00 ........ .......
76 45 cb 0a 00 00 00 00 f0 73 ea 6a 00 00 00 00 vE.......s.j....
90 10 46 0f 00 00 00 00 68 8e dd 39 06 00 00 00 ..F.....h..9....
34 09 cb 23 06 00 00 00 96 64 0f ee 0c 00 00 00 4..#.....d......
90 fe 5e b2 00 00 00 00 b8 38 07 00 6c e5 01 00 ..^......8..l...
00 00 00 00 00 00 ec 80 10 00 00 00 6d 20 00 00 ............m ..

Windows has finished checking your disk.
Please wait while your computer restarts.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


----------



## Cookiegal (Aug 27, 2003)

Is your system XP Pro or Home?


----------



## Goldfinger (Feb 19, 2006)

Home


----------



## Cookiegal (Aug 27, 2003)

You will need to get this hotfix from Microsoft to fix the Application Management errors:

http://support.microsoft.com/kb/328213

Please run it for a day and then check the Event Viewer again and post any new errors that have occurred since running chkdsk.

If you haven't yet gotten the MS hotfix, there's no need to post the Applicattion Management errors (event id: 7023) as they will keep occurring over and over again until the fix is applied.


----------



## Goldfinger (Feb 19, 2006)

So basically you are saying I'm screwed until I get this so called fixed from Microsoft which naturally wont be free? :down:


----------



## Cookiegal (Aug 27, 2003)

No, not at all. This error is not what's causing your problems. But it's a nuisance. It is free though. MS provides the hotfix without charge. Just be sure you mention that up front.


----------



## Goldfinger (Feb 19, 2006)

I'm trying to contact microsoft to see if they will give me the hotfix. In the meantime, what else can i do to solve my problem(s)?

Thank you.


----------



## Cookiegal (Aug 27, 2003)

As I mentioned, run it for a day and then post any new errors that have occurred since chkdsk was run.

Also, let's do a couple of scans.

*Download and scan with* *SUPERAntiSpyware* Free for Home Users
Double-click *SUPERAntiSpyware.exe* and use the default settings for installation. 
An icon will be created on your desktop. Double-click that icon to launch the program. 
If asked to update the program definitions, click "*Yes*". If not, update the definitions before scanning by selecting "*Check for Updates*". (_If you encounter any problems while downloading the updates, manually download and unzip them from here._) 
Under "*Configuration and Preferences*", click the *Preferences* button. 
Click the *Scanning Control* tab. 
Under *Scanner Options* make sure the following are checked _(leave all others unchecked)_:
_Close browsers before scanning._ 
_Scan for tracking cookies._ 
_Terminate memory threats before quarantining._

Click the "*Close*" button to leave the control center screen. 
Back on the main screen, under "*Scan for Harmful Software*" click *Scan your computer*. 
On the left, make sure you check *C:\Fixed Drive*. 
On the right, under "*Complete Scan*", choose *Perform Complete Scan*. 
Click "*Next*" to start the scan. Please be patient while it scans your computer. 
After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "*OK*". 
Make sure everything has a checkmark next to it and click "*Next*". 
A notification will appear that "_Quarantine and Removal is Complete_". Click "*OK*" and then click the "*Finish*" button to return to the main menu. 
If asked if you want to reboot, click "*Yes*". 
To retrieve the removal information after reboot, launch SUPERAntispyware again.
_Click *Preferences*, then click the *Statistics/Logs* tab._ 
_Under Scanner Logs, double-click *SUPERAntiSpyware Scan Log*._ 
_If there are several logs, click the current dated log and press *View log*. A text file will open in your default text editor._ 
*Please copy and paste the Scan Log results in your next reply.*

Click *Close* to exit the program.

Please run Kaspersky online virus scan *Kaspersky Online Scanner*.

After the updates have downloaded, click on the "Scan Settings" button.
Choose the *"Extended database" *for the scan.
Under "Please select a target to scan", click "My Computer".
When the scan is finished, Save the results from the scan!

*Note:* You have to use Internet Explorer to do the online scan.

*Post a new HiJackThis log along with the results from the SuperAntiSpyware and Kaspersky scans.*


----------



## Goldfinger (Feb 19, 2006)

Ran Superantispyware.

It found several hundred cookie type adwares. Nothing else. Than after rebooting, it acted like yesterday when I went through the Scan Disk except faster this time. I dont know if thats related to Superantispyware or not. I wrote as much of that screen down as I could before it finished:

CHKDSK
Deleting corrupt file record segment 59420
Deleting corrupt atribute record (16,0) from file record segment 78195
Deleting corrupt record segment 78195
There were a few other lines but came and went too quick for me to manually copy.

Than after putting in my P/W for windows, this error came up:
Svchost.exe Application Error
The intruction at "0x77e93362" referenced memory at "0x00000400, the memory could not be read....1st time I've seen that.

After clicking to terminate, it booted to desktop. It allowed me to open Superantispyware, but wouldnt let me see the log. I couldnt get into internet explorer or restart system in normal way. Basically it was frozen which had not happened before. So I did a cold reboot. This time after putting in windows password at log-in prompt, it would not load my desktop settings. I cold rebooted again and went into safe mode. There I was able to read superantispyware log. The problem is I cant get into IE to paste it for you since it keeps saying microsoft IE has seen an error and is shutting down.

I will keep trying to send you the log and than try Kasperky. I wanted to get this info to you before I forgot anything important.


----------



## Goldfinger (Feb 19, 2006)

After the 5 minutes it took to post last message, I was than able to boot up troubled machine in normal mode with only one error message:

runtime error

Program Superantispyware. This application has requested the runtime to terminate it in an unusual way. Contact application support team for more information.

Heres the Superantispyware log in two pieces:

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 05/01/2008 at 08:13 PM

Application Version : 4.0.1154

Core Rules Database Version : 3451
Trace Rules Database Version: 1443

Scan type : Complete Scan
Total Scan Time : 00:34:41

Memory items scanned : 334
Memory threats detected : 0
Registry items scanned : 6285
Registry threats detected : 0
File items scanned : 122293
File threats detected : 472

Adware.Tracking Cookie
C:\Documents and Settings\Cliff.TIGER.000\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff.TIGER.000\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff.TIGER.000\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff.TIGER.000\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff.TIGER.000\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff.TIGER.000\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff.TIGER.000\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff.TIGER.000\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff.TIGER.000\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][3].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][3].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][4].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][3].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][3].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][4].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][3].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][3].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][4].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][5].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][6].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][7].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected]www.worldgroups[1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][3].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][3].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][4].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][5].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][4].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][3].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][4].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][6].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][7].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][4].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][3].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][3].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][4].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][5].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][3].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][4].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][5].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][3].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][4].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][5].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][6].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][3].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][4].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][3].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][4].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][5].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][3].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][4].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][5].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][3].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][3].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][5].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][3].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][4].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected]zilla[1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][4].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][3].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][4].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][5].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][6].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt


----------



## Goldfinger (Feb 19, 2006)

Rest of log:

C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected]****-love[2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected]****ingdamnit[1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][3].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][4].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][5].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][6].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][7].txt
C:\Documents and Settings\Cliff\Cookies\[email protected]eadservices[8].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][9].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected]****[2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][2].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt
C:\Documents and Settings\Cliff\Cookies\[email protected][1].txt


----------



## Goldfinger (Feb 19, 2006)

Kaspersky scan:

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Thursday, May 01, 2008 11:53:22 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 2/05/2008
Kaspersky Anti-Virus database records: 735173
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 124187
Number of viruses found: 6
Number of infected objects: 27
Number of suspicious objects: 5
Duration of the scan process: 01:31:16

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\Cliff\Desktop\Hijack logs\SmitfraudFix\Reboot.exe	Infected: not-a-virus:RiskTool.Win32.Reboot.f	skipped
C:\Documents and Settings\Cliff\Desktop\Hijack logs\SmitfraudFix.exe/data.rar/SmitfraudFix/Reboot.exe	Infected: not-a-virus:RiskTool.Win32.Reboot.f	skipped
C:\Documents and Settings\Cliff\Desktop\Hijack logs\SmitfraudFix.exe/data.rar	Infected: not-a-virus:RiskTool.Win32.Reboot.f	skipped
C:\Documents and Settings\Cliff\Desktop\Hijack logs\SmitfraudFix.exe	RarSFX: infected - 2	skipped
C:\Documents and Settings\Cliff\Local Settings\Application Data\Identities\{DFF16927-88E6-4EAA-A097-460B7E65289B}\Microsoft\Outlook Express\Inbox.dbx/[From "[email protected]" <[email protected]>][Date Wed, 01 Jun 2005 12:15:53 +0300]/UNNAMED/html	Suspicious: Trojan-Spy.HTML.Fraud.gen	skipped
C:\Documents and Settings\Cliff\Local Settings\Application Data\Identities\{DFF16927-88E6-4EAA-A097-460B7E65289B}\Microsoft\Outlook Express\Inbox.dbx/[From "[email protected]" <[email protected]>][Date Wed, 01 Jun 2005 12:15:53 +0300]/UNNAMED	Suspicious: Trojan-Spy.HTML.Fraud.gen	skipped
C:\Documents and Settings\Cliff\Local Settings\Application Data\Identities\{DFF16927-88E6-4EAA-A097-460B7E65289B}\Microsoft\Outlook Express\Inbox.dbx	MailMSOutlook5: suspicious - 2	skipped
C:\Documents and Settings\Cliff\My Documents\Misc\mail backup\Hotmail - Deleted Items.dbx/[From Mail Administrator <[email protected]>][Date Sat, 11 Sep 2004 12:01:07 +0200]/UNNAMED/UNNAMED/[From [email protected]][Date Sat, 11 Sep 2004 12:01:02 +0200]/data.zip/document.txt .exe	Infected: Email-Worm.Win32.NetSky.q	skipped
C:\Documents and Settings\Cliff\My Documents\Misc\mail backup\Hotmail - Deleted Items.dbx/[From Mail Administrator <[email protected]>][Date Sat, 11 Sep 2004 12:01:07 +0200]/UNNAMED/UNNAMED/[From [email protected]][Date Sat, 11 Sep 2004 12:01:02 +0200]/data.zip	Infected: Email-Worm.Win32.NetSky.q	skipped
C:\Documents and Settings\Cliff\My Documents\Misc\mail backup\Hotmail - Deleted Items.dbx/[From Mail Administrator <[email protected]>][Date Sat, 11 Sep 2004 12:01:07 +0200]/UNNAMED/UNNAMED	Infected: Email-Worm.Win32.NetSky.q	skipped
C:\Documents and Settings\Cliff\My Documents\Misc\mail backup\Hotmail - Deleted Items.dbx/[From Mail Administrator <[email protected]>][Date Sat, 11 Sep 2004 12:01:07 +0200]/UNNAMED	Infected: Email-Worm.Win32.NetSky.q	skipped
C:\Documents and Settings\Cliff\My Documents\Misc\mail backup\Hotmail - Deleted Items.dbx/[From MAILER-DAEMON (Mail Delivery System)][Date Tue, 14 Sep 2004 19:56:02 +0000 (UCT)]/UNNAMED/UNNAMED/[From [email protected]][Date Tue, 14 Sep 2004 21:55:47 +0200]/Informations.zip/Informations.txt .exe	Infected: Email-Worm.Win32.NetSky.aa	skipped
C:\Documents and Settings\Cliff\My Documents\Misc\mail backup\Hotmail - Deleted Items.dbx/[From MAILER-DAEMON (Mail Delivery System)][Date Tue, 14 Sep 2004 19:56:02 +0000 (UCT)]/UNNAMED/UNNAMED/[From [email protected]][Date Tue, 14 Sep 2004 21:55:47 +0200]/Informations.zip	Infected: Email-Worm.Win32.NetSky.aa	skipped
C:\Documents and Settings\Cliff\My Documents\Misc\mail backup\Hotmail - Deleted Items.dbx/[From MAILER-DAEMON (Mail Delivery System)][Date Tue, 14 Sep 2004 19:56:02 +0000 (UCT)]/UNNAMED/UNNAMED	Infected: Email-Worm.Win32.NetSky.aa	skipped
C:\Documents and Settings\Cliff\My Documents\Misc\mail backup\Hotmail - Deleted Items.dbx/[From MAILER-DAEMON (Mail Delivery System)][Date Tue, 14 Sep 2004 19:56:02 +0000 (UCT)]/UNNAMED	Infected: Email-Worm.Win32.NetSky.aa	skipped
C:\Documents and Settings\Cliff\My Documents\Misc\mail backup\Hotmail - Deleted Items.dbx/[From [email protected]][Date Mon, 20 Sep 2004 12:02:45 +0200]/UNNAMED/file.txt	Infected: Email-Worm.Win32.NetSky.q	skipped
C:\Documents and Settings\Cliff\My Documents\Misc\mail backup\Hotmail - Deleted Items.dbx/[From [email protected]][Date Mon, 20 Sep 2004 12:02:45 +0200]/UNNAMED	Infected: Email-Worm.Win32.NetSky.q	skipped
C:\Documents and Settings\Cliff\My Documents\Misc\mail backup\Hotmail - Deleted Items.dbx/[From [email protected]][Date Tue, 21 Sep 2004 08:45:01 +0200]/UNNAMED/data.doc	Infected: Email-Worm.Win32.NetSky.q	skipped
C:\Documents and Settings\Cliff\My Documents\Misc\mail backup\Hotmail - Deleted Items.dbx/[From [email protected]][Date Tue, 21 Sep 2004 08:45:01 +0200]/UNNAMED	Infected: Email-Worm.Win32.NetSky.q	skipped
C:\Documents and Settings\Cliff\My Documents\Misc\mail backup\Hotmail - Deleted Items.dbx/[From <[email protected]>][Date Tue, 21 Sep 2004 20:16:29 +0100]/UNNAMED/photo.zip/photo.jpg .scr	Infected: Email-Worm.Win32.Mabutu.a	skipped
C:\Documents and Settings\Cliff\My Documents\Misc\mail backup\Hotmail - Deleted Items.dbx/[From <[email protected]>][Date Tue, 21 Sep 2004 20:16:29 +0100]/UNNAMED/photo.zip	Infected: Email-Worm.Win32.Mabutu.a	skipped
C:\Documents and Settings\Cliff\My Documents\Misc\mail backup\Hotmail - Deleted Items.dbx/[From <[email protected]>][Date Tue, 21 Sep 2004 20:16:29 +0100]/UNNAMED	Infected: Email-Worm.Win32.Mabutu.a	skipped
C:\Documents and Settings\Cliff\My Documents\Misc\mail backup\Hotmail - Deleted Items.dbx/[From [email protected]][Date Wed, 22 Sep 2004 23:40:11 -0400]/UNNAMED/data_goldfingerpg2.txt.pif	Infected: Email-Worm.Win32.NetSky.q	skipped
C:\Documents and Settings\Cliff\My Documents\Misc\mail backup\Hotmail - Deleted Items.dbx/[From [email protected]][Date Wed, 22 Sep 2004 23:40:11 -0400]/UNNAMED	Infected: Email-Worm.Win32.NetSky.q	skipped
C:\Documents and Settings\Cliff\My Documents\Misc\mail backup\Hotmail - Deleted Items.dbx/[From Mail Delivery Subsystem <[email protected]>][Date Sat, 25 Sep 2004 00:08:09 +0200]/UNNAMED/[From [email protected]]/UNNAMED/[From [email protected]][Date Sat, 25 Sep 2004 00:03:29 +0200]/UNNAMED/html	Suspicious: Exploit.HTML.Iframe.FileDownload	skipped
C:\Documents and Settings\Cliff\My Documents\Misc\mail backup\Hotmail - Deleted Items.dbx/[From Mail Delivery Subsystem <[email protected]>][Date Sat, 25 Sep 2004 00:08:09 +0200]/UNNAMED/[From [email protected]]/UNNAMED/[From [email protected]][Date Sat, 25 Sep 2004 00:03:29 +0200]/UNNAMED	Suspicious: Exploit.HTML.Iframe.FileDownload	skipped
C:\Documents and Settings\Cliff\My Documents\Misc\mail backup\Hotmail - Deleted Items.dbx/[From Mail Delivery Subsystem <[email protected]>][Date Sat, 25 Sep 2004 00:08:09 +0200]/UNNAMED/[From [email protected]]/UNNAMED/[From [email protected]][Date Sat, 25 Sep 2004 00:03:29 +0200]/message.scr	Infected: Email-Worm.Win32.NetSky.q	skipped
C:\Documents and Settings\Cliff\My Documents\Misc\mail backup\Hotmail - Deleted Items.dbx/[From Mail Delivery Subsystem <[email protected]>][Date Sat, 25 Sep 2004 00:08:09 +0200]/UNNAMED/[From [email protected]]/UNNAMED	Infected: Email-Worm.Win32.NetSky.q	skipped
C:\Documents and Settings\Cliff\My Documents\Misc\mail backup\Hotmail - Deleted Items.dbx/[From Mail Delivery Subsystem <[email protected]>][Date Sat, 25 Sep 2004 00:08:09 +0200]/UNNAMED	Infected: Email-Worm.Win32.NetSky.q	skipped
C:\Documents and Settings\Cliff\My Documents\Misc\mail backup\Hotmail - Deleted Items.dbx/[From [email protected]][Date Sat, 25 Sep 2004 00:09:03 +0200]/UNNAMED/application.txt	Infected: Email-Worm.Win32.NetSky.q	skipped
C:\Documents and Settings\Cliff\My Documents\Misc\mail backup\Hotmail - Deleted Items.dbx/[From [email protected]][Date Sat, 25 Sep 2004 00:09:03 +0200]/UNNAMED	Infected: Email-Worm.Win32.NetSky.q	skipped
C:\Documents and Settings\Cliff\My Documents\Misc\mail backup\Hotmail - Deleted Items.dbx	MailMSOutlook5: infected - 22, suspicious - 2	skipped
C:\Documents and Settings\Cliff.TIGER.000\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\DSAgnt.log	Object is locked	skipped
C:\Documents and Settings\Cliff.TIGER.000\Cookies\INDEX.DAT	Object is locked	skipped
C:\Documents and Settings\Cliff.TIGER.000\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat	Object is locked	skipped
C:\Documents and Settings\Cliff.TIGER.000\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat	Object is locked	skipped
C:\Documents and Settings\Cliff.TIGER.000\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG	Object is locked	skipped
C:\Documents and Settings\Cliff.TIGER.000\Local Settings\History\History.IE5\INDEX.DAT	Object is locked	skipped
C:\Documents and Settings\Cliff.TIGER.000\Local Settings\History\History.IE5\MSHist012008050120080502\index.dat	Object is locked	skipped
C:\Documents and Settings\Cliff.TIGER.000\Local Settings\Temp\AVP1378.tmp	Object is locked	skipped
C:\Documents and Settings\Cliff.TIGER.000\Local Settings\Temp\AVP1379.tmp	Object is locked	skipped
C:\Documents and Settings\Cliff.TIGER.000\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat	Object is locked	skipped
C:\Documents and Settings\Cliff.TIGER.000\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT	Object is locked	skipped
C:\Documents and Settings\Cliff.TIGER.000\NTUSER.DAT	Object is locked	skipped
C:\Documents and Settings\Cliff.TIGER.000\ntuser.dat.LOG	Object is locked	skipped
C:\Documents and Settings\LocalService\Cookies\INDEX.DAT	Object is locked	skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat	Object is locked	skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG	Object is locked	skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\INDEX.DAT	Object is locked	skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT	Object is locked	skipped
C:\Documents and Settings\LocalService\ntuser.dat	Object is locked	skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG	Object is locked	skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat	Object is locked	skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG	Object is locked	skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT	Object is locked	skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG	Object is locked	skipped
C:\System Volume Information\MountPointManagerRemoteDatabase	Object is locked	skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP60\change.log	Object is locked	skipped
C:\WINDOWS\Debug\PASSWD.LOG	Object is locked	skipped
C:\WINDOWS\Prefetch\USERINIT.EXE-0743FDA9.pf	Object is locked	skipped
C:\WINDOWS\SchedLgU.Txt	Object is locked	skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log	Object is locked	skipped
C:\WINDOWS\Sti_Trace.log	Object is locked	skipped
C:\WINDOWS\SYSTEM32\CatRoot2\edb.log	Object is locked	skipped
C:\WINDOWS\SYSTEM32\CatRoot2\tmp.edb	Object is locked	skipped
C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt	Object is locked	skipped
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT	Object is locked	skipped
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG	Object is locked	skipped
C:\WINDOWS\SYSTEM32\CONFIG\Internet.evt	Object is locked	skipped
C:\WINDOWS\SYSTEM32\CONFIG\SAM	Object is locked	skipped
C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG	Object is locked	skipped
C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt	Object is locked	skipped
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY	Object is locked	skipped
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG	Object is locked	skipped
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE	Object is locked	skipped
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG	Object is locked	skipped
C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt	Object is locked	skipped
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM	Object is locked	skipped
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG	Object is locked	skipped
C:\WINDOWS\SYSTEM32\H323LOG.TXT	Object is locked	skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR	Object is locked	skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.MAP	Object is locked	skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING.VER	Object is locked	skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING1.MAP	Object is locked	skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING2.MAP	Object is locked	skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA	Object is locked	skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.MAP	Object is locked	skipped
C:\WINDOWS\WIADEBUG.LOG	Object is locked	skipped
C:\WINDOWS\WIASERVC.LOG	Object is locked	skipped
C:\WINDOWS\WindowsUpdate.log	Object is locked	skipped

Scan process completed.

Hijackthis scan:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:56:03 PM, on 5/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\Cliff.TIGER.000\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareBlock Class - {0A87E45F-537A-40B4-B812-E2544C21A09F} - C:\Program Files\SpyCatcher 2006\SCActiveBlock.dll (file missing)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: RefresherBand Class - {B24BA06E-FB7B-4757-95C2-DC01125F750E} - C:\PROGRA~1\YREFRE~1\YREFRE~1.DLL
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00C0A1F2-D492-4DBA-A8E2-76CB1B791724} (TNPLDownloader Control) - https://dtwx2.accuweather.com/tnpl_awda/client/download/TNPLDownloader.cab
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://supportcenter.rr.com/sdccommon/download/tgctlcm.cab
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/us/kavwebscan_unicode.cab
O16 - DPF: {430DDE24-C051-11CF-95BE-0020AFF75E4F} (ichat xchat Control) - http://142.179.159.11:7080/chat/data/html/user/msie/msichat.ocx
O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} (TLIEFlashObj Class) - https://echat.us.dell.com/Media/VisitorChat/TLIEFlash.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SupportSoft RemoteAssist - SupportSoft, Inc. - C:\Program Files\Common Files\supportsoft\bin\ssrc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 7231 bytes


----------



## Cookiegal (Aug 27, 2003)

Kasperky found some old infected e-mails that you need to locate and delete:

Outlook Express inbox:

[From "[email protected]" <[email protected]>][Date Wed, 01 Jun 2005 12:15:53 +0300]

Hotmail - Deleted items:

/[From Mail Administrator <[email protected]>][Date Sat, 11 Sep 2004 12:01:07 +0200]
/[From MAILER-DAEMON (Mail Delivery System)][Date Tue, 14 Sep 2004 19:56:02 +0000 (UCT)]
/[From [email protected]][Date Mon, 20 Sep 2004 12:02:45 +0200]
/[From [email protected]][Date Tue, 21 Sep 2004 08:45:01 +0200]
/[From <[email protected]>][Date Tue, 21 Sep 2004 20:16:29 +0100]
/[From [email protected]][Date Wed, 22 Sep 2004 23:40:11 -0400]
/[From Mail Delivery Subsystem <[email protected]>][Date Sat, 25 Sep 2004 00:08:09 +0200]
/[From [email protected]][Date Sat, 25 Sep 2004 00:09:03 +0200]

Rescan with HijackThis, close all browser windows except HijackThis, put a check mark beside these entries and click *fix checked*.
*
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE*

Are there any new errors today?


----------



## Goldfinger (Feb 19, 2006)

Unfortunately today things have gotten worse. I havent been able to get into windows at all today, even safe mode. I keep getting this BLUE screen:

_A problem has been detected and windows has been shut down to prevent damage to your computer.

If this is the first time you've seen this stop error screen, restart your computer. If this screen appears again, follow these steps:

Disable or uninstall any anti-virus, disk defragmentation or back-up utiltities. Check your hard drive configuration, and check for any updated drivers. Run CHKDSK/F to check for hard drive corruption and than restart your computer.

Technical information:

*** STOP: 0x00000024 ( 0x00190203, 0x86EEF248, 0xC0000102, 0x00000000 )_

----------------------------

You think my internal Hard drive is about to crash or maybe has already? Its strange it wants me to scan disk F drive when my internal hard drive is C. I do have an external HD with the F drive letter but havent had it hooked up or powered on since problems started. Maybe the drive letters somehow got switched?

Is there a way I can get past the current blue screen and hopefully get back to windows? Than I can try and find those emails and use hijackthis to delete that one file for ya.

I wonder if some of my new error/warning messages have to do with not having any windows security updates any more. I used to have 30 plus until I lost my desktop plus other settings. Everything acts like I just bought new computer in that it wants me to install programs such as Jason's photo shop and windows media, for example, when clicking on a .jpg or .mpeg file.

Just my two cents....

Are you going to be on this weekend? I sure hope so.


----------



## Cookiegal (Aug 27, 2003)

Have you tried booting to Last Known Good Configuration? That is the first thing to try.

If not, see if you can boot to safe mode or safe mode with command prompt.


----------



## Goldfinger (Feb 19, 2006)

Same blue screen message when trying to boot to last known good configuration, safe mode, or safe mode with command prompt. The error message numbers are a little different if that helps

Last known good configuration:
*** STOP: 0x00000024 ( 0x00190203, 0x86F52A98, 0xC0000102, 0x00000000 )

Safe mode:
*** STOP: 0x00000024 ( 0x00190203, 0x86F8C690, 0xC0000102, 0x00000000 )

Safe mode with command prompt:
*** STOP: 0x00000024 ( 0x00190203, 0x86F3A098, 0xC0000102, 0x00000000 )


----------



## Cookiegal (Aug 27, 2003)

As part of running ComboFix, you installed the recovery console so this should help you.

When booting the computer, you should see an option to boot to the recovery console. Select that option. You have to log on as the Administrator. When prompted type the Administrator password. If the administrator password is blank, just press ENTER.

You should see a prompt for C:\Windows (this is where we enter commands). If ti doesn't say C:\Windows, let me know please.

If it does then at the command prompt type the following (be sure to include the space between the k and the /):

*chkdsk /r*

Type exit to exit the recovery console and reboot. Let me know how it goes please.


----------



## Goldfinger (Feb 19, 2006)

I was really hoping that was gonna work, but I got the same blue screen with error message. It never asked for an administrator password if that helps....It loaded the recovery console and than the blue screen appeared.


----------



## Cookiegal (Aug 27, 2003)

Did you get as far as the C:\Windows prompt?


----------



## Cookiegal (Aug 27, 2003)

Try disconnecting all hardware except what's necessary.


----------



## Cookiegal (Aug 27, 2003)

I just want to let you know that our site is going down for a major upgrade in less than an hour and will be down for at least 24 hours so don't be alarmed if you can't access the site. We may have to continue tomorrow evening.

Did you back up your important data and stuff from the hard drive?


----------



## Goldfinger (Feb 19, 2006)

It never allowed me to get to the C\ windows prompt.

I have some stuff backed up, but not some other important stuff. What really angers me is that as late as yesterday I think I could've backed them as well, but didnt think the hard drive was going to be a problem. I was too focused on malware/adware problems.

I just tried disconnecting whatever wasnt needed from computer and it didnt help. HOWEVER, I noticed the fan doesnt turn as fast as it used to and theres a noise that I think is coming from the general area of the power supply. If I'm not getting the right power supply could that cause my current problem?

If its not the power supply, and it is my HD, is all info lost from it forever?

Thanks for heads-up on the site shut down.


----------



## Cookiegal (Aug 27, 2003)

A faulty power supply could be the problem causing overheating. Can you try a new one? 

If that doesn't solve the problem, it's possible the drive can be slaved to another for the purpose of recovering data.


----------



## Goldfinger (Feb 19, 2006)

I dont have another power supply to try. I just looked at it more closely and that may not be the problem. Hard to tell how much power its suppose to put out. Its not overheating.

When the forum gets back online we can discuss how to slaved the HD. I have a place for two HDs so hopefully whatever you mean is possible. Have a good weekend.


----------



## Goldfinger (Feb 19, 2006)

In the past several hours I learned some more.....By hitting F12 or maybe it was F2 while booting, I made it to a hardware screen that runs self diagnosis. It did the whole hardware system and kept saying there was a *memory* problem. The *hard drive* checked ok. The memory errors were:

System memory Test: MATS

Error code 2F00:0119
MSG: System memory failure. Read 00004000h, expected 00000000h at address 1B7D49E0h. Suspected memory component located on system board at label channel B DIMM 0.

There were 6 errors all the same except the numbers a little different.

Than another 6 errors for each of these system memory tests:
March A test
March B test
March C test
March X test
March Y test
Data line test

All for *Channel B Dimm 0* (whatever that means)

Again no hard drive errors. It past all its test.

---------------------------------

Another thing I managed to do was change the boot sequence so it doesnt go into Hard Drive 1st. Now it goes 1st into CD-Rom. I have windows XP installation on CD, and was able to get into System Recovery Console twice (one time I couldnt). You made an earlier post about seeing a *C:\Windows* prompt. It gave me a *C:\>* prompt instead. You said to tell you 1st if it was a different prompt. What do I need to tell it for this type of prompt? We were going to try and make it run a scan disk check to hopefully fix whatever wasnt allowing me into normal windows.

Hopefully this will help us.


----------



## JohnWill (Oct 19, 2002)

Well, a memory test is BAD news! You MUST fix that or you'll never make any progress. It's telling you that the memory module in channel B slot 0 is bad.


----------



## Goldfinger (Feb 19, 2006)

Its definitely a memory problem. I was able to get around it and get back into windows where I backed-up the rest of my important files. If interested I can go into detail which might helps others. I feel my hard drive is fine (at least today) 

Theres no need for me to go any further until I get the new memory sticks. The question is what do you want to do about this thread? I will still have some problems once my hardware is fixed. Including the problem you noted in my last hijackthis log and getting my settings/desktop/shortcuts back....Should we close this now and have me start a new one or leave this open so you will have a reference?

No matter what is decided, I want to thank you Cookiegal for once again helping me. Its people like you that make computers safer for people like me. :up:


----------



## Cookiegal (Aug 27, 2003)

That's great. A big thanks to JohnWill too. 

Once you get your memory fixed up please post back here with a new HijackThis log. The thread will remain open.


----------



## Goldfinger (Feb 19, 2006)

Hi

I now have new memory cards. I ran a complete hardware check and everything passes just fine! I can boot into windows. So at least that problem is fixed.  

You asked me to run a new hijackthis log, but I dont think it will help at this time. Remember how I keep saying my desktop doesnt have the right icons and my unit settings have changed? This all happened when we were 1st trying to fix my problem(s). During one of several times that I was forced to reboot, it rebooted into a desktop but not mine. What apparently happened is windows created new user accounts. This explains why nothing looks familar to me and why clicking on an icon makes it try to install it as if it was the 1st time....The good new is see my settings/files/shortcuts by way of Explorer Bar folders. The problem is when I log in I go to the wrong account. Originally XP only allows two accounts. In my case its mine (Cliff) and another account (Bob) that never gets used. When my problem happened, for some reason windows created several other accounts. Both start with Cliff, but have other letters added. 

I now see:
Administrator
All Users
All Users* * = a square symbol
Cliff
Cliffxxxx
Cliffyyyy
Bob
Owner

(its not really cliffxxxx or cliffyyyy, but you get the idea)

Only Cliff, Bob, All Users and I guess Administrator and maybe Owner should be there? I went to ControlPanel/User account and just see Cliff and Bob so I cant fix it there. 

I may have to go into the registry but dont know where. Maybe using system restore and going back would remove those other names? Any ideas?


----------



## Goldfinger (Feb 19, 2006)

Heres the latest hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:10:54 PM, on 5/6/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Cliff.TIGER.000\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareBlock Class - {0A87E45F-537A-40B4-B812-E2544C21A09F} - C:\Program Files\SpyCatcher 2006\SCActiveBlock.dll (file missing)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: RefresherBand Class - {B24BA06E-FB7B-4757-95C2-DC01125F750E} - C:\PROGRA~1\YREFRE~1\YREFRE~1.DLL
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00C0A1F2-D492-4DBA-A8E2-76CB1B791724} (TNPLDownloader Control) - https://dtwx2.accuweather.com/tnpl_awda/client/download/TNPLDownloader.cab
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://supportcenter.rr.com/sdccommon/download/tgctlcm.cab
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/us/kavwebscan_unicode.cab
O16 - DPF: {430DDE24-C051-11CF-95BE-0020AFF75E4F} (ichat xchat Control) - http://142.179.159.11:7080/chat/data/html/user/msie/msichat.ocx
O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} (TLIEFlashObj Class) - https://echat.us.dell.com/Media/VisitorChat/TLIEFlash.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SupportSoft RemoteAssist - SupportSoft, Inc. - C:\Program Files\Common Files\supportsoft\bin\ssrc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 7238 bytes


----------



## Cookiegal (Aug 27, 2003)

Let's try running the User Profile Hive Cleanup utility:

http://www.microsoft.com/downloads/...6D-8912-4E18-B570-42470E2F3582&displaylang=en

Let me know how it goes please.


----------



## Goldfinger (Feb 19, 2006)

Before you made the post to install the Hive cleanup utility, I did a lot of reading and looked closely at the last hijackthis report I made. I noticed this: *C:\Documents and Settings\Cliff.TIGER.000\Desktop\HiJackThis .exe*. The correct settings should point to just *Cliff * I decided to be brave and went into the registry to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Currentversion\Profilelist. Thats where all user profiles are suppose to be located. After backing up the registry, I modified it to read just *Cliff*. After rebooting, my settings, emails, updates, etc all came back to how I had them before my memory card died. That made me happy. 

Than I deleted one user folder in *My Computer\Documents and Settings *that I knew didnt belong. It was unfortunately replaced by "Default User". And I still have 3 users including the Cliff Tiger 000. I dont think any of them belong, but dont want to screw anything up so not sure I want to delete them too.

I'm glad you pointed me to the Hive Cleanup since my event viewer was showing several warning messages with the same error number that Hive was made to fix. So far since installing, no more of those warning messages. Thank you. Will keep you posted.

My system is near 100% back to normal so we've made great progress. Am getting an Event Viewer error code 10010 saying: _The server did not register with DCOM within the required timeout._

Please look at this latest hijackthis log and see if you want me to do anything more. BTW, I reinstalled AVG.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:08:19 AM, on 5/9/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\UPHClean\uphclean.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myfoxtampabay.com/myfox/...d=ABADCBC60E674D9A92384382D4056CE7?pageId=9.1
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareBlock Class - {0A87E45F-537A-40B4-B812-E2544C21A09F} - C:\Program Files\SpyCatcher 2006\SCActiveBlock.dll (file missing)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: RefresherBand Class - {B24BA06E-FB7B-4757-95C2-DC01125F750E} - C:\PROGRA~1\YREFRE~1\YREFRE~1.DLL
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AccuWeatherDesktopAlerts] C:\Program Files\AccuWeatherDesktopAlerts\AccuWeatherDesktopAlerts.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00C0A1F2-D492-4DBA-A8E2-76CB1B791724} (TNPLDownloader Control) - https://dtwx2.accuweather.com/tnpl_awda/client/download/TNPLDownloader.cab
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://supportcenter.rr.com/sdccommon/download/tgctlcm.cab
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/us/kavwebscan_unicode.cab
O16 - DPF: {430DDE24-C051-11CF-95BE-0020AFF75E4F} (ichat xchat Control) - http://142.179.159.11:7080/chat/data/html/user/msie/msichat.ocx
O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} (TLIEFlashObj Class) - https://echat.us.dell.com/Media/VisitorChat/TLIEFlash.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SupportSoft RemoteAssist - SupportSoft, Inc. - C:\Program Files\Common Files\supportsoft\bin\ssrc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 7744 bytes


----------



## Cookiegal (Aug 27, 2003)

Good job. :up: You definitely need the Default User folder so don't delete that. It looks like Windows creates new accounts with .000, possibly to protect profiles during failures. I would leave them all alone as I don't anticipate them causing any problems.The DCOM error you describe is common and should not be a problem.

Rescan with HijackThis, close all browser windows except HijackThis, put a check mark beside these entries and click *fix checked*.

*O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE*

Here are some final instructions for you.

The following program will remove the tools we've used and their associated files and backups and then it will delete itself.

Please download *OTMoveIt2 by OldTimer*.

*Save* it to your *desktop*.
Make sure you have an Internet Connection.
Double-click *OTMoveIt.exe* to run it. (Vista users, please right-click on *OTMoveIt2.exe* and select "Run as an *Administrator*")
Click on the *CleanUp!* button
A list of tool components used in the cleanup of malware will be downloaded.
If your firewall or real-time protection attempts to block OTMoveIt2 to reach the Internet, please allow the application to do so.
Click Yes to begin the cleanup process and remove these components, including this application which will delete itself.
You will be asked to reboot the machine to finish the cleanup process. If you are asked to reboot the machine choose *Yes.*

Now you should turn system restore off to flush out all previous system restore points, then turn it back on and create a new restore point:

To turn off system restore, on the Desktop, right click on *My Computer* and click on *Properties.*
Click the *System Restore* tab.
Check *Turn off System Restore.*
Click Apply and then click OK.

Restart your computer, turn System Restore back on and create a restore point.

To create a new restore point, click on *Start* - *All Programs* - *Accessories* - *System Tools* and then select *System Restore*.

In the System Restore wizard, select *Create a restore point* and click the Next button.

Type a name for your new restore point then click on Create.

I also recommend downloading  *SPYWAREBLASTER* for added protection.

*Read here* for info on how to tighten your security.

Delete Temporary Files:

Go to *Start* - *Run* and type in *cleanmgr* and click OK. 
Let it scan your system for files to remove. 
Make sure Temporary Files, Temporary Internet Files, and Recycle Bin are the only things checked. 
Press OK to remove them.

You should trim down your start-ups (these show as the 04 entries in your HijackThis log) as there are too many running. You can research them at these sites and if they aren't required at start-up then you can uncheck them in msconfig via Start - Run - type msconfig click OK and then click on the start-up tab.

http://castlecops.com/StartupList.html
http://www.bleepingcomputer.com/startups/
http://www.windowsstartup.com/wso/index.php


----------



## Goldfinger (Feb 19, 2006)

I did all the things you asked in last post including getting rid of about half of my start-up list. Thanks for including those websies. Made another System Restore point. Am using Spywareblaster, etc.

The DCOM error has to do with Windows Media Player + PNP and SSDP. I get the error using Windows Media Player and the fix has something to do with PNP and/or SSDP. I will research it on my own so you can help others. As you said, it doesnt seem to hurt anything.

Some questions:

1. Microsoft security just released SP3. I know past service packs have had problems when they 1st came out. Do you recommend me getting this now?
2. I dont like the new AVG 8.0. Is there another similar program you'd recommend?
3. Should I install Zonealarm or keep using the XP firewall?

Thank you once again for all your help Cookiegal!


----------



## Cookiegal (Aug 27, 2003)

Can you please post the exact DCOM error from the Event Viewer.

I would hold off installing SP3 for a while. Since it was pushed through updates, many people are having problems.


----------



## Goldfinger (Feb 19, 2006)

Here it is:

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10010
Date: 5/9/2008
Time: 3:11:14 AM
User: TIGER\Cliff
Computer:	TIGER
Description:
The server {204810B9-73B2-11D4-BF42-00B0D0118B56} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------------------------

Hmmm, now that I see it this way, I wonder if its because its trying to use two user names? Maybe unistall/reinstall Windows Media Player?

I know for a fact that it has to do with WMP because I can get the error any time I want by trying to open a video file through WMP. An offspring of the error message is for some reason sometimes the player wont play the video when double clicking. The FULL file name changes to a part name between double left clicks. This doesnt happen all the time. An example is if file was named: "ZZZZZZ YYYYY EEEEE", after the 1st click and before the 2nd click, the file name would shorten to "ZZZZZZ YYYYY" and not open. IF the FULL file named remained, than it would open. Using one right click than play command plays the file. The error is logged in viewer even if the file opens so its not because of the file not opening, but because WMP is involved somehow.

I noticed no response about my Zonealarm and AVG question


----------



## Cookiegal (Aug 27, 2003)

Sorry. Instead of AVG you can use Avast which is also free.

Yes, I would use ZoneAlarm rather than just the Windows XP firewall.


I would try uninstalling and reinstalling Windows Media Player.


----------



## Goldfinger (Feb 19, 2006)

Uninstalling/reinstalling windows media player 11 didnt help.....I did some more research online and it still comes down to windows media player, Universal plug n play, and SSDP service.

When I take the event log error message number: 204810B9-73B2-11D4-BF42-00B0D0118B56. and look for it in the registry I find it in: HKEY_CLASSES_ROOT\CLSID\{204810b9-73b2-11d4-bf42-00b0d0118b56} 
The default is: UPnPRegistrar
The application ID is: {E495081B-BBA5-4b89-BA3C-3B86A686B87A}

Here are the two events that *ALWAYS* occur right before the system error in the event viewer:

1st:

Event Type:	Information
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7035
Date: 5/14/2008
Time: 2:41:50 AM
User: NT AUTHORITY\SYSTEM
Computer:	TIGER
Description:
The Universal Plug and Play Device Host service was successfully sent a start control.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

2nd:

Event Type:	Information
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7036
Date: 5/14/2008
Time: 2:41:50 AM
User: N/A
Computer:	TIGER
Description:
The Universal Plug and Play Device Host service entered the stopped state.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Than the error:

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10010
Date: 5/14/2008
Time: 2:42:20 AM
User: TIGER\Cliff
Computer:	TIGER
Description:
The server {204810B9-73B2-11D4-BF42-00B0D0118B56} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

----------------------------------------------------------------------------

It seems like something needs to be registered within 30 seconds by dont know what. WMP never asks that I register it when installing. I dont know if the "users" in all the events being different has anything to do with it.

Does that help any?


----------



## Cookiegal (Aug 27, 2003)

Go to Start - Run - type in the following and click OK.

*services.msc*

Scroll down to the SSDP Discovery Service, double-click to open it and let me know if this service status is "started".


----------



## Goldfinger (Feb 19, 2006)

Yes SSDP is started. Its set at "automatic". So is Plug n Play for that matter. If I disable SSDP, than WMP actually works the way it used to where I dont have to wait about 30 seconds between starting videos. I can close and than immediately play another. However doing so than give me these Event Viewer errors. Now its possible that before my recent problems, SSDP was disabled and I never knew it because until I met you, I didnt know there was an Event Viewer 

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10005
Date: 5/14/2008
Time: 8:30:55 PM
User: TIGER\Cliff
Computer:	TIGER
Description:
DCOM got error "The dependency service or group failed to start. " attempting to start the service upnphost with arguments "" in order to run the server:
{204810B9-73B2-11D4-BF42-00B0D0118B56}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
-----------------------------------------------------------------------
Followed by:

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7001
Date: 5/14/2008
Time: 8:30:55 PM
User: N/A
Computer:	TIGER
Description:
The Universal Plug and Play Device Host service depends on the SSDP Discovery Service service which failed to start because of the following error: 
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


----------



## Cookiegal (Aug 27, 2003)

Since this is not really my area, I suggest you start a new thread in the XP forum for help with those errors.


----------



## Goldfinger (Feb 19, 2006)

Ok thanks for all your help.


----------



## Cookiegal (Aug 27, 2003)

You're welcome and good luck.


----------

