# Sound loop/strange crashing



## Daniel0000 (Aug 30, 2004)

So, during a game, my comp. will crash.
During a high performance game like half-life 2, or during low performance warcraft III with all settings turned on low! Even in the menu screen, when I'm not actually playing.
This takes as little as 5 minutes and as much as 2 hours to crash.
The game will start to choke up, then it will freeze. I will hear the last sound played loop a few times. Then, usually, a bunch of strange colors pop up around the screen. Then, the monitors power off (or standby, or whatever). I can't ctrl alt del, or alt f4 or anything. I have to manually restart. When I get back on, sometimes my computer is put down at 16b or at a different resolution and my icons all move around.

I've done everything I can.
Virus scans, ad scans, cws, memtests, hardware tests in system setup, changing settings, reinstalling things. It's beyond my abilities. Any help out there?


----------



## Daniel0000 (Aug 30, 2004)

Heat: maybe.
But fans are tested as working, and I've checked graphics card, so it's working. Also, note comp. crashes during high performance games and low performance games. And even after being on for a day, it's 30 seconds into a game with lower performance than other programs that crashes.
Drivers intalled, uninstalled updated. Using ati's catalyst 5.13

Run s+D, ad-aware, spywareblaster, and have mcafee checking. also did trend micro and avg scans.
Good # of programs running, but shut a lot of 'em down, and turned a bunch of startups off. Seems to crash either way.

Yes, x800xt, 3.4ghz 2xraid 0 raptors, creative audigy 2 zs.
Nothing abornmal happened. Oddly enough, it won't let me do a system restore...

Did diagnostic tests in the setup menu and card, fans and hard drives all passed...


----------



## Super-D-38 (Apr 25, 2002)

Have you done any upgrades?

From your first post, I would say it's the card.. could be going bad.. they don't always just fail.

And to test heat, take the case off and use a house fan to blow air in.. 
Even fans that turn and test OK, could be clogged with dust under them.. Or just bad ventilation in your case..

Example of my ventilation; I have 3 case fans, one in the side blowing in, and two in back blowing out.. Much better flow that way.

I guess even, your temp shut down may be to low... If you motherboard has it that is.. But we'll leave that for much later in the help process.


----------



## Daniel0000 (Aug 30, 2004)

No ocing or anything. Installed one 400gb hard drive and a tv tuner about a year ago.
It doesn't look too dusty and the XPS has decent ventilation. Left it open with a regular cheap house fan. It does crash in low and high performance things. (would wc3 with all settings on low--in the menu--really overtax a graphics card....). I don't think I can install my own fans on the XPS. Tearing some holes in the case would probably void the warrantee. 
Doesn't feel too hot and doesn't seem like heat is necessarily the problem. 

Temp shut down... don't know much about that.

It's also hard to test, because sometimes the computer runs two hours of a game before crashing. Sometimes it crashes after 5 minutes though. Hard for me to tell. Could run a game overnight with the comp. open and a fan running on the inside, if you suggest.
However, the fans seem to be working and I don't *think* that there would be a ton of dust after only a year. Looked pretty clean.

Let's keep up the troubleshooting! Step two, baby. Dell technical support has nothing on you 
Much thanks,
~D


----------



## Super-D-38 (Apr 25, 2002)

Well, I don't know how dusty your house is, but I've had my case for about 2 months, and it looks like I'll need to clean it again.. 
Course I have a dog and live out in the "woods", on a gravel road too.. so, dust is everywhere. 

So everything has worked up till recently?.. hmm. 

Just so I'm clear on it, what video card do you have?


----------



## Daniel0000 (Aug 30, 2004)

Yep, about two weeks.
I can check again and clean it out a bit.
ati x800xt.


----------



## Super-D-38 (Apr 25, 2002)

The card is to old to take back?... Is there still warranty on it? 
I just have a hunch your card may be going bad..
Did you update the drivers right before the crashes?... Or have you tried any older versions of drivers? 

But I'm far from an expert, so we can wait for more help..


----------



## Mayor Quimby (Jul 7, 2004)

try downloading 35marko5, which is free to determing if its the video card. If ur pc doesnt pass the test, it could be your soundcard. 

Also, because i had experience this myself, i can tell you that defective video card can test built into windows easily. I bought a ati radeon 9800 when Half life 2 came out, and it was defective but still passing the test built into windows. But when i played games, my graphics were still corruped.


----------



## Daniel0000 (Aug 30, 2004)

Yes, at least 3 years of warranty left.
I have run all the 3dmarks (including 06') several times. However, it has crashed sometimes in these tests. Now it runs through them all fine.
Did get a blue screen finally! Not during a game or anything. Had iTunes, browser and maybe a download running. So maybe not graphics card after all....
I have not rolled back to an old driver. The crashing did seem to start within about a week of updating to the ATI catalyst 5.13... I have unisntalled/reinstalled these, but maybe there's some incompatibility.
OCing, voids the warranty? Graphics and processor? There's some tool called ati overdrive that's part of the catalyst driver. No 3rd party tool. Must be some sort of overclock.


----------



## Super-D-38 (Apr 25, 2002)

Yes try an older driver.. nVidia had some bad ones come out recently, it would cause mine to go goofy, so maybe you got some bad ones.. 

What did the blue screen say? Sometimes it tells what file is crashing.


----------



## Rollin' Rog (Dec 9, 2000)

When you exit one of these games after encountering problems, do this before rebooting:

Do ctrl-alt-del to open up the task manager. Select the "performance" tab. Let me know what you see under:

*Physical Memory*

*Total:* (this is your total installed ram -- "physical" memory)
*Available:* (this is the amt of real "physical" memory presently uncommitted)

*Commit Charge*

*Total:* (this is the combination of total physical and virtual memory currently in use)
*Limit:* (this is the total physical and virtual memory available)
*Peak:* (this is the most you have had in use in this session)


----------



## Daniel0000 (Aug 30, 2004)

Problem is, I can't exit the games before rebooting. The monitors are powered off and I can't ctrl alt del or alt f4 or anything. Have to do a hard reboot.

Right now,
Physical Mem
Total 104612
Available 502840

Commit Charge
Total 382220
Limit 3506832
Peak 1126444

Getting a cable for my camera. Took a picture of the blue screen and will post this afternoon.


----------



## Rollin' Rog (Dec 9, 2000)

Well the symptoms sound like resource depletion, but an overheating cpu or display card could also account for it. You can try exiting a game before it actually freezes and give me what you see then.

I still haven't seen a recent scanlog from you, but in any case here's one test to try:

Before beginning a game open the Task Manager and terminate all processes with a User Name Except Explorer.exe.

I guess you will also need to leave Steam, in the case of HL2, and any processes required for connectivity. I'm not sure what they might be in your case, but you can experiment.

Also try running some of these games offline and see if you have problems there.

If you are getting blue screens navigate to c:\windows\minidump and copy some of the recent dump files to a new folder, zip the folder and upload it here.


----------



## Daniel0000 (Aug 30, 2004)

It's hard for me to tell when exactly it's going to freeze, so I'm not sure about being able to exit the game and look then. Why would internet effect it? It's a very frustrating problem, as it happens in as little as 5 minutes and as long as 3-4 hours. I never know when or how much it's going to crash. This is the blue screen I got, attached.
If I terminate all the processes and it works fine, it would then be some sort of software error? I had one crash yesterday, and then a run for 3 or 4 hours with no problems.
I did run an overnight memtest with no errors.


----------



## Rollin' Rog (Dec 9, 2000)

You can check out the "8E" STOP articles on this site:

http://aumha.org/win5/kbestop.htm

If you terminate all User Name processes as indicated and it works fine, that means there is a resource or other conflict issue with those one of those processes.

The internet aspect is relevant when the BSODs might be due to problems with your modem, nic card, router -- or in some cases the particular server which you are connected to. Some of these servers run anti-cheat software which searches all mounted drives for known cheats during the game play. I have seen cases where these caused certain types of STOP errors similar to what you have here.

There is no driver mentioned in your STOP error, but the location is possibly in the region of the ntsokrnl.dll. It may be display driver related.

If you can go to c:\windows\minidump and copy some of the dump files there to a new folder, and zip and upload that folder here, I'd like to see it.

By the way, in these games, how do you have the sound options configured? Are you using software drivers or hardware acceleration?


----------



## Daniel0000 (Aug 30, 2004)

I can probably test the games without internet for a bit. Would you reccomend putting everything on highest settings for that test?
Not running any internet cheats, so I hope that's not the problem.

Dolby Digital Surround or whatever seems closest to 5 channel.
I am running klipsch promedia 5.1s.
However, they're not digital input. Again, I have run all of these games before for almost a year with settings maxed and no crashes. So resource problems would be a little odd.

Maybe the router? My router has a habit of turning off when I wake up and get home from school. I just do a power cycle with it and it works fine. But 75% of the time I'm away for an extended period, it shuts itself off... I also can log onto Xbox Live with it, but experience terrible lag. Bypassing and connecting through the modem works perfectly.

Here's the attachment.


----------



## Rollin' Rog (Dec 9, 2000)

By all means max out your settings if you were not having any previous problems. Also try to minimize your running processes for a test

But are you saying you can play those games fine if you just connect the computer directly to the modem? If so, then you have a problem with Belkin wireless router I would think.

I can't extract those minidump files because you basically double compressed them -- once as .rar files and then again as zip files.

When I try to extract the .rar files using PowerArchiver, I get a "crc" error -- meaning they are corrupt in some way.

Just copy the minidumps to a new folder then right clck on that folder and select "compress" from the Right Click menu. That should just zip them in XPs default zip program.


----------



## Daniel0000 (Aug 30, 2004)

Alright will do.
Crashed again under high settings online in WC3, which, relatively, isn't a very intense game. Took about an hour to crash though. Same thing, had to do a hard reboot. Every user process I could close was closed.


----------



## Rollin' Rog (Dec 9, 2000)

Of the minidumps you copied I have looked at 3. The earliest 1/10/06 occured in a driver called cap713x.sys. Not much on it, but it appears to be a video capture driver of some kind.

The second, on 1/11/06 occured in an ATI driver; It's hard to find a common element here, frankly.

The most recent, and possibly most significant (1/23/06) occured in ctoss2k.sys -- an Audigy Sound card driver.

For yuks I'm uploading the text file debug using MS debugging tools -- just so you can have a gander.

Mind you these are only your Blue Screen STOP messages -- nothing is logged when you freeze and have to force reboot.

>> I'm still not clear if you are having these problems when connected directly to the modem with no intervening router or wireless connection.


----------



## Daniel0000 (Aug 30, 2004)

Yeah, I do have a TV Tuner Card installed.
There might be some problems with the sound card, Audigy ZS Pro, but I'm not sure.
Ran a game all day (just waiting in the game's menu) with no internet connected, and it was frozen in the same way when I came home.
Thoughts?


----------



## Rollin' Rog (Dec 9, 2000)

And this only happens in games? Is the fan on the Video card working? What have you done to test the overheating possiblities?

Ati has a driver removal utility on their site -- If you decide to do a driver rollback or reinstall, I would run it as part of the procedure.

https://support.ati.com/ics/support/KBAnswer.asp?questionID=1447


----------



## Daniel0000 (Aug 30, 2004)

Did a reinstall before. Do you think I should do it again?
Only games so far. And even just in the menu. The fan is working. I rendered a movie on Maya all night long and nothing crashed. So it seems like it's not overheating.
Another note: it won't let me system restore. Says that restore failed, and I tried 3 or 4 different points.


----------



## Daniel0000 (Aug 30, 2004)

Another strange thing.
Upon this last freeze, my computer restarted with non-transparent desktop icons. So far, resolution, location of icons, color from 32-16 and now the transparency of the words on the icons.


----------



## Rollin' Rog (Dec 9, 2000)

Are you seeing any errors in the event viewer?

System restore may be damaged -- if you cannot even create a new restore point and restore to it -- turn it off, then reboot and turn it back on again and test.

With respect to your icons -- check your settings in System Properties > Advanced > Performance > Visual effects.

These affect some of the changes you are seeing. The setting which makes the text part of the icons transparent is called "drop shadows".

Something is happening that is causing Windows to change settings to recover performance. Typically this is a memory issue.

You may need to monitor this more aggressively.

Perhaps create a reduced window for the game and keep the task manager performance window open with it. Watch the "peak" value and see if it goes steadily up with the game running.


----------



## Daniel0000 (Aug 30, 2004)

Alright I'll run with the performance window open.
I was able to restore to a point from this morning, but not from one about a week ago.
Colors change, resolution change, and desktop settings. Apparently memory related, as you say. 
This may just be my total ignorance, but I took a game out of the cd drive after it froze, and it was very hot. I may have missed this for years, but I never remember CDs becoming hot. Is a faulty drive possible?
I'll be gone out of town for a bit.
Thanks


----------



## Rollin' Rog (Dec 9, 2000)

I've never noticed CDs getting hot.

It could be heat migrating upward in the case.

You need to monitor temperatures.

If MBM5 is compatible with your motherboard you can use it for real time monitoring:

http://www.majorgeeks.com/download.php?det=311

PC Wizard is a comprehensive System Information utility that also provides temp and voltage monitoring -- however I don't believe the voltage monitors are reliable.

http://www.cpuid.com/pcwizard.php

My advice about restores is just to create system checkpoints manually before making any driver changes.


----------



## Zman1764 (Jun 2, 2005)

it sounds like either your video card or sound card are bad...


----------



## Daniel0000 (Aug 30, 2004)

Yup still crashes, even in the menu of a game.
I'll run these two tests.
Monitored the performance as I played a game. When the computer started, it was spiking all over the place, up too a 100 and such. During the game, it stayed between 48-54 % and crashed spontananeously.


----------



## Rollin' Rog (Dec 9, 2000)

The cpu usage isn't an issue, if that is what you were looking at. Try running a game which uses less memory resources and monitor the "peak" value -- it should not be so closely approaching or exceeding installed ram.

And try to get a reading of temps using MBM5 or another utility. You should also visually verify that the ATI card fan is running and free of dust.


----------



## Daniel0000 (Aug 30, 2004)

says 32 fahrenheit for case and cpu.
Fan is running and I cleaned it off, so it should be dust-free.

Should I be in the performance menu, or in processes, watching the memory usage?


----------



## Rollin' Rog (Dec 9, 2000)

32 or 132? That's got to be a false reading. Even if it is in centigrade, it is abnormally low (90 f). Was it PC Wizard or something else you used to get the reading? 132 F would be in a reasonable range.

Watch the Peak usage in the performance tab. You can switch to processes to see where it is going if it gets near the installed ram.


----------



## Daniel0000 (Aug 30, 2004)

Definitley 32. I know that's way too cold.
The motherboard program didn't have support for my particular motherboard, I think. 
Note: When my comp. freezes, the cpu usage drops to 0 for everything.
Peak usage, under commit charge? 
The memory on the game did creep up from 50mb to almost 200mb, but I didn't test it past that. My comp has been doing the 'explorer.exe is crashed' and has also had an 'svchost.exe' is crashed. They keep on showing 'don't send/ error report' boxes. Comp. has also crashed in game menu and when game is minimized.
Here's a screenshot. See 32 on the bottom right?


----------



## Rollin' Rog (Dec 9, 2000)

I can't see anything from the screenshot.

You have a Dell, right? MBM5 does not run on the one's I've tried it on. I can get a reading from PC Wizard though. Don't trust the voltage readings you see with it.

http://www.cpuid.com/pcwizard.php

You are are getting explorer and svchost errors outside of gaming? What is the pattern?


----------



## Daniel0000 (Aug 30, 2004)

2 times, after restarting, it will show the 'application has unexpectedly crashed' and explorer will close. It then restarts and closes almost immediately.
Once, the same thing happened to svchost. These are after restarting from crashes.
Other things that have happened, 'the audio device supported by this application is not deteced. the application will exit. when I try to open my creative sound mixer, and 'there are no active mixer devices available....this program will now close' when i try to open volume control.
127.4 degrees fahr is what i'm getting now. I just had to uninstall MBM.


----------



## Rollin' Rog (Dec 9, 2000)

I've run across that exact problem several times before with no certain resolution. In some cases it appeared to be the result of unfinished Windows updates. Do you have automatic update enabled? And if so, does Windows update still show that you have not fully installed all available updates?

I'd like to see what services are running under svchost.exe. To run the command I want, you need to have a copy of tasklist.exe in the system32 folder. Unless you have XP PRO you will need to download it from here:

http://www.computerhope.com/download/winxp.htm

Then go to Start > Run, enter cmd

At the command prompt copy/paste this into the window and hit "enter":

*cd %userprofile%\desktop
tasklist /svc /fi "imagename eq svchost.exe" >> taskservlist.txt*

A text file should appear on your desktop. Copy/paste the contents of that here.

127 F is not hot enough to be responsible for problems.


----------



## Daniel0000 (Aug 30, 2004)

Windows Update is updated.
It keeps on giving me a blank text file. Maybe I'm typing it wrong?
One optical drive no longer appears under my computer, "windows cannot read from this disk. the disk might be corrupted, or it could be using a format that is not compatible with windows." This happened after the last crash with the game in the drive.
The computer evolves! Sometimes, the keyboard only responds every 3rd or 4th keystroke, which is very annoying. The problems keep on changing.


----------



## Rollin' Rog (Dec 9, 2000)

Don't type it, just do a standard copy/paste. You can highlight the text, right click > copy, then right click on the cmd window and select "paste". Then just hit enter.

Post another HijackThis scanlog while your at it.

Check the event viewer for new errors as well (run eventvwr.msc). You can also copy/paste those by viewing the description and selecting the double-paper copy icon.


----------



## Daniel0000 (Aug 30, 2004)

New problems! No sound at all now. Gives "the audio device supported by this application is not detected. the application will exit." when opening my creative sound mixer or volume control. Playing music files won't advance.
Reinstalled sound drivers. 
Found and eixplorer.exe (spyware in system32) in panda scan and a spyware ctfmon.exe (panda also).
Note: for the svchost.exe taskserver thing, when my computer starts, it says svchost has crashed. So I don't know if the run cmd caught everything or not...
Here's the svchost list, hjt log and eventviewer logs.
Thanks

Logfile of HijackThis v1.99.1
Scan saved at 11:21:07 PM, on 2/4/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe
C:\Program Files\Appearance\Stardock\Object Desktop\WindowBlinds\wbload.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\PRISMSVR.EXE
C:\Program Files\Alias\Maya6.0\docs\Wrapper.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Alias\Maya7.0\docs\wrapper.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
c:\PROGRA~1\mcafee.com\vso\OasClnt.exe
C:\Program Files\Alias\Maya7.0\docs\jre\bin\java.exe
C:\Program Files\McAfee.com\Personal Firewall\MPFTray.exe
C:\PROGRA~1\mcafee.com\agent\McAgent.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
C:\Program Files\Common Files\Stardock\TrayServer.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
c:\program files\mcafee.com\vso\mcvsshld.exe
G:\Tools\volumouse\volumouse.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Terminator\TV7131 Utilities\P3XRCtl.exe
C:\Program Files\Appearance\Stardock\DesktopGadgets\AquariumDesktop2006\AquariumDesktop2006.exe
C:\Program Files\Alias\Maya6.0\docs\jre\bin\java.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Security\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\mqsvc.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\PROGRA~1\INTERNET\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\Daniel\Desktop\Security\CWShredder\cwshredder.exe
C:\Documents and Settings\Daniel\Desktop\Security\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Security\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [MPFEXE] "C:\Program Files\McAfee.com\Personal Firewall\MPFTray.exe"
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\McAgent.exe
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [1A:Stardock TrayMonitor] C:\Program Files\Common Files\Stardock\TrayServer.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [$Volumouse$] "G:\Tools\volumouse\volumouse.exe" /nodlg
O4 - Startup: AquariumDesktop2006.lnk = C:\Program Files\Appearance\Stardock\DesktopGadgets\AquariumDesktop2006\AquariumDesktop2006.exe
O4 - Global Startup: TV Remote Control.lnk = C:\Program Files\Terminator\TV7131 Utilities\P3XRCtl.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {01CA75F1-054B-4A63-9221-C6926369EC52} (HS_live Control) - http://install.homestead.com/~site/InstallFiles/SIFiles/lpxlive/HS_live.cab
O16 - DPF: {0F9B4CA4-A30F-480A-841D-69B45C50A8F8} - 
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,96/mcinsctl.cab
O16 - DPF: {5AA5A569-F96F-4628-A528-8B3698F558BB} (HS_live Control) - http://install.homestead.com/~site/InstallFiles/SIFiles/lpxlive/HS_live.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab
O16 - DPF: {E856B973-45FD-4559-8F82-EAB539144667} (Dell PC Checkup Installer Control) - 
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,wbsys.dll
O20 - Winlogon Notify: MCPClient - C:\PROGRA~1\COMMON~1\Stardock\mcpstub.dll
O20 - Winlogon Notify: WB - C:\PROGRA~1\APPEAR~1\Stardock\OBJECT~2\WINDOW~1\fastload.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Alias Documentation Server (aliasdocserver) - Unknown owner - C:\Program Files\Alias\Maya6.0\docs\Wrapper.exe" -s "C:\Program Files\Alias\Maya6.0\docs/Wrapper.conf (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: hpdj - Unknown owner - C:\DOCUME~1\Daniel\LOCALS~1\Temp\hpdj.exe (file missing)
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Maya 7.0 Documentation Server (maya70docserver) - Unknown owner - C:\Program Files\Alias\Maya7.0\docs\wrapper.exe" -s "C:\Program Files\Alias\Maya7.0\docs\Wrapper.conf (file missing)
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Security\Webroot\Spy Sweeper\WRSSSDK.exe

Image Name PID Services 
========================= ====== =============================================
SVCHOST.EXE 1648 DcomLaunch, TermService 
SVCHOST.EXE 1724 RpcSs 
SVCHOST.EXE 1932 Dnscache 
SVCHOST.EXE 2040 Alerter, LmHosts, SSDPSRV, upnphost, 
WebClient 
SVCHOST.EXE 3224 stisvc 
SVCHOST.EXE 4048 wuauserv 
SVCHOST.EXE 2684 BITS, EventSystem, helpsvc, Netman, Nla, 
Schedule, SENS, Themes, winmgmt


----------



## Rollin' Rog (Dec 9, 2000)

For the time being, if there are no further Windows updates to be installed -- disable the Windows update service.

Also disable the Background Intelligent Transfer Service (BITS). You can find it in the services profile (run services.msc) -- set the startup mode to disabled.

--------

You have a lot of things starting and running whose role is either unknown to me or questionable. I would simplify your startup profile by disabling unneeded applications in msconfig.

Some I quesion are:

C:\Program Files\Alias\Maya6.0\docs\jre\bin\java.exe (I don't know what is running this, do you start it manually? What is it, a graphics development program?)

O4 - Startup: AquariumDesktop2006.lnk = C:\Program Files\Appearance\Stardock\DesktopGadgets\AquariumDesktop2006\AquariumDeskto p2006.exe
O4 - Global Startup: TV Remote Control.lnk = C:\Program Files\Terminator\TV7131 Utilities\P3XRCtl.exe

> Are you running a game server or other server application? (http://www.liutilities.com/products/wintaskspro/processlibrary/inetinfo/) Where is that inetinfo.exe process coming from?

---------

Personally I would uninstall the entire Stardock application and Webroot software as well.

You should also remove and reinstall your Sound Card software.

>> Post a new Scanlog and Svchost list when you have made some siginificant changes -- and let me know wha results, if any, have occured.


----------



## Daniel0000 (Aug 30, 2004)

Windows Update and BITS disabled.
Maya is a graphics program, but I don't know why it would be on during startup....
Aquariam Desktop is a desktop theme/style and such.
Terminator is my tv tuner's remote control (which I don't use, and have turned off).
Should dumpprep 0 -k be a startup?

I wondered about inetinfo myself. Definitely not running a game server. I've cancelled it many times, and I can't figure out what it does. Always been suspicious of it.

Reinstalled sound card and uninstalled webroot. I got the stardock recently, but if you think it's potentially bad, I can get rid of it.

Same behavior. Crashes after a random amount of time. It hasn't changed the resolution or color recently, but has done the "windows explorer has unexpectedly quit" and also no sound working a few times each. Also, keyboard not responding has happened a few times.

Just opened hijack this, and a loud ringing/buzz noise rang for about fifteen seconds... Very strange.

Logfile of HijackThis v1.99.1
Scan saved at 8:15:19 PM, on 2/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe
C:\Program Files\Appearance\Stardock\Object Desktop\WindowBlinds\wbload.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\PRISMSVR.EXE
C:\Program Files\Alias\Maya6.0\docs\Wrapper.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Alias\Maya7.0\docs\wrapper.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
c:\PROGRA~1\mcafee.com\vso\OasClnt.exe
C:\Program Files\Alias\Maya7.0\docs\jre\bin\java.exe
c:\program files\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
c:\program files\mcafee.com\agent\mcagent.exe
C:\Program Files\McAfee.com\Personal Firewall\MPFTray.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
G:\Tools\volumouse\volumouse.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Alias\Maya6.0\docs\jre\bin\java.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Azureus\Azureus.exe
C:\WINDOWS\system32\mqsvc.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Program Files\Java\jre1.5.0_06\bin\javaw.exe
C:\Program Files\Ahead\Nero ShowTime\ShowTime.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Outlook Express\msimn.exe
C:\PROGRA~1\INTERNET\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\divxsm.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Daniel\Desktop\Security\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Security\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [MPFEXE] "C:\Program Files\McAfee.com\Personal Firewall\MPFTray.exe"
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\McAgent.exe
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [$Volumouse$] "G:\Tools\volumouse\volumouse.exe" /nodlg
O4 - Startup: AquariumDesktop2006.lnk = C:\Program Files\Appearance\Stardock\DesktopGadgets\AquariumDesktop2006\AquariumDesktop2006.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {01CA75F1-054B-4A63-9221-C6926369EC52} (HS_live Control) - http://install.homestead.com/~site/InstallFiles/SIFiles/lpxlive/HS_live.cab
O16 - DPF: {0F9B4CA4-A30F-480A-841D-69B45C50A8F8} - 
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,96/mcinsctl.cab
O16 - DPF: {5AA5A569-F96F-4628-A528-8B3698F558BB} (HS_live Control) - http://install.homestead.com/~site/InstallFiles/SIFiles/lpxlive/HS_live.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab
O16 - DPF: {E856B973-45FD-4559-8F82-EAB539144667} (Dell PC Checkup Installer Control) - 
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,wbsys.dll
O20 - Winlogon Notify: MCPClient - C:\PROGRA~1\COMMON~1\Stardock\mcpstub.dll
O20 - Winlogon Notify: WB - C:\PROGRA~1\APPEAR~1\Stardock\OBJECT~2\WINDOW~1\fastload.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Alias Documentation Server (aliasdocserver) - Unknown owner - C:\Program Files\Alias\Maya6.0\docs\Wrapper.exe" -s "C:\Program Files\Alias\Maya6.0\docs/Wrapper.conf (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: hpdj - Unknown owner - C:\DOCUME~1\Daniel\LOCALS~1\Temp\hpdj.exe (file missing)
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Maya 7.0 Documentation Server (maya70docserver) - Unknown owner - C:\Program Files\Alias\Maya7.0\docs\wrapper.exe" -s "C:\Program Files\Alias\Maya7.0\docs\Wrapper.conf (file missing)
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe

Image Name PID Services 
========================= ====== =============================================
SVCHOST.EXE 1648 DcomLaunch, TermService 
SVCHOST.EXE 1724 RpcSs 
SVCHOST.EXE 1932 Dnscache 
SVCHOST.EXE 2040 Alerter, LmHosts, SSDPSRV, upnphost, 
WebClient 
SVCHOST.EXE 3224 stisvc 
SVCHOST.EXE 4048 wuauserv 
SVCHOST.EXE 2684 BITS, EventSystem, helpsvc, Netman, Nla, 
Schedule, SENS, Themes, winmgmt

Image Name PID Services 
========================= ====== =============================================
SVCHOST.EXE 1588 DcomLaunch, TermService  
SVCHOST.EXE 1664 RpcSs 
SVCHOST.EXE 1792 AudioSrv, BITS, Browser, CryptSvc, Dhcp, 
dmserver, EventSystem, helpsvc, HidServ, 
lanmanserver, lanmanworkstation, Netman, 
Nla, Schedule, seclogon, SENS, SharedAccess, 
ShellHWDetection, srservice, Themes, TrkWks, 
w32time, winmgmt, wscsvc, WZCSVC 
SVCHOST.EXE 1884 Dnscache 
SVCHOST.EXE 2008 Alerter, LmHosts, SSDPSRV, upnphost, 
WebClient 
SVCHOST.EXE 3404 stisvc 
SVCHOST.EXE 736 wuauserv 
SVCHOST.EXE 1208 HTTPFilter


----------



## Rollin' Rog (Dec 9, 2000)

BITS and Windows Update (wuauserv) are still in the svchost list, so they are not set to "disabled" as a startup mode.

I think inetinfo is being run by the "Maya" program -- so I would uninstall that or disable everything associated with it. It is starting as a service.

O23 - Service: *Maya 7.0 Documentation Server* (maya70docserver) - Unknown owner - C:\Program Files\Alias\Maya7.0\docs\wrapper.exe" -s "C:\Program Files\Alias\Maya7.0\docs\Wrapper.conf (file missing)

dumpprep can be deleted, but will return if you get a blue screen or other Windows crash.

Really I would try to simplify things as much as possible, get down to the basics. Antivirus, Windows firewall and not much else. Otherwise you are probably looking at a clean install.

C:\Program Files\Azureus\Azureus.exe

^^ something else which should not be running, was it manually started?



> loud ringing/buzz noise rang for about fifteen seconds... Very strange.


This could be very significant as it sounds like a motherboard alarm -- overheating, low voltage, fan failure. Do you have a motherboard monitor running?


----------



## Daniel0000 (Aug 30, 2004)

My bad-I hadn't restarted before I posted the log and svchost list.
I did disable both, as well as all the Maya things.
Azureus is a program-disabled it.
When I try to open Hijack this, it says Unexpected Error. Tried to download a new one, but go tthe same thing.
When I try to open startuplist.exe, it says "Failed to load control 'imagelist' from mscomctl.ocx. Your version of mscomctl.ocx may be outdated. Make sure you are using the version of the control that was provided with your application."

I have motherboard monitor and pcwizard installed, but not running (unless they're in the background??)

Installed a windows update manually. Sounded potentially important for me.
Security Update for Windows XP (KB912919)
Brief Description
A remote code execution security issue has been identified in the Graphics Rendering Engine that could allow an attacker to remotely compromise your Windows-based system and gain control over it.

I'll try to restart and see if I can get HJT to open.


----------



## Rollin' Rog (Dec 9, 2000)

Motherboard monitor won't do you any good if is not compatible with your Dell mobo. If it is, and is running, it should show up in the System Tray area.

PC Wizard has to be launched manually. I don't know what it will tell you on your particular Dell; on mine it only gives the hard disk temp.

I have version 6.0.81.77 of mscomctl.ocx in c:\windows\system32 -- what do you have?


----------



## Daniel0000 (Aug 30, 2004)

How do I tell?


----------



## Rollin' Rog (Dec 9, 2000)

Find the file, right click on it and select Properties > version; or you may simply be able to mouse over it and see its version properties.


----------



## Daniel0000 (Aug 30, 2004)

mscomctl.ocx is file version 6.1.95.45
There's also a mscomct2 6.0.88.4


----------



## Rollin' Rog (Dec 9, 2000)

I don't believe the later file version should be a problem. And what changes have occured since you last ran HijackThis other than the Windows update?


----------



## Daniel0000 (Aug 30, 2004)

Just the ones you suggested.
Got HJT to open. A few freeze/crashes occurred, one in about 1 hour and 1 after about 2 minutes, in games.
realsched.exe likes to re-start itself up every time I play a real player file.

Logfile of HijackThis v1.99.1
Scan saved at 8:52:32 AM, on 2/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe
C:\Program Files\Appearance\Stardock\Object Desktop\WindowBlinds\wbload.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\PRISMSVR.EXE
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\McAfee.com\Personal Firewall\MPFTray.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\PROGRA~1\mcafee.com\agent\McAgent.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
c:\program files\mcafee.com\agent\mcdetect.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
G:\Tools\volumouse\volumouse.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
c:\PROGRA~1\mcafee.com\vso\OasClnt.exe
c:\program files\mcafee.com\vso\mcvsshld.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\ups.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\mqsvc.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\INTERNET\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\Daniel\Desktop\Security\hijackthis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Security\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [MPFEXE] "C:\Program Files\McAfee.com\Personal Firewall\MPFTray.exe"
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\McAgent.exe
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [$Volumouse$] "G:\Tools\volumouse\volumouse.exe" /nodlg
O4 - Startup: AquariumDesktop2006.lnk = C:\Program Files\Appearance\Stardock\DesktopGadgets\AquariumDesktop2006\AquariumDesktop2006.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {01CA75F1-054B-4A63-9221-C6926369EC52} (HS_live Control) - http://install.homestead.com/~site/InstallFiles/SIFiles/lpxlive/HS_live.cab
O16 - DPF: {0F9B4CA4-A30F-480A-841D-69B45C50A8F8} - 
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,96/mcinsctl.cab
O16 - DPF: {5AA5A569-F96F-4628-A528-8B3698F558BB} (HS_live Control) - http://install.homestead.com/~site/InstallFiles/SIFiles/lpxlive/HS_live.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab
O16 - DPF: {E856B973-45FD-4559-8F82-EAB539144667} (Dell PC Checkup Installer Control) - 
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,wbsys.dll
O20 - Winlogon Notify: MCPClient - C:\PROGRA~1\COMMON~1\Stardock\mcpstub.dll
O20 - Winlogon Notify: WB - C:\PROGRA~1\APPEAR~1\Stardock\OBJECT~2\WINDOW~1\fastload.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: hpdj - Unknown owner - C:\DOCUME~1\Daniel\LOCALS~1\Temp\hpdj.exe (file missing)
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe

Image Name PID Services 
========================= ====== =============================================
SVCHOST.EXE 1648 DcomLaunch, TermService 
SVCHOST.EXE 1724 RpcSs 
SVCHOST.EXE 1932 Dnscache 
SVCHOST.EXE 2040 Alerter, LmHosts, SSDPSRV, upnphost, 
WebClient 
SVCHOST.EXE 3224 stisvc 
SVCHOST.EXE 4048 wuauserv 
SVCHOST.EXE 2684 BITS, EventSystem, helpsvc, Netman, Nla, 
Schedule, SENS, Themes, winmgmt

Image Name PID Services 
========================= ====== =============================================
SVCHOST.EXE 1588 DcomLaunch, TermService 
SVCHOST.EXE 1664 RpcSs 
SVCHOST.EXE 1792 AudioSrv, BITS, Browser, CryptSvc, Dhcp, 
dmserver, EventSystem, helpsvc, HidServ, 
lanmanserver, lanmanworkstation, Netman, 
Nla, Schedule, seclogon, SENS, SharedAccess, 
ShellHWDetection, srservice, Themes, TrkWks, 
w32time, winmgmt, wscsvc, WZCSVC 
SVCHOST.EXE 1884 Dnscache 
SVCHOST.EXE 2008 Alerter, LmHosts, SSDPSRV, upnphost, 
WebClient 
SVCHOST.EXE 3404 stisvc 
SVCHOST.EXE 736 wuauserv 
SVCHOST.EXE 1208 HTTPFilter

Image Name PID Services 
========================= ====== =============================================
SVCHOST.EXE 1580 DcomLaunch, TermService 
SVCHOST.EXE 1684 RpcSs 
SVCHOST.EXE 1800 AudioSrv, Browser, CryptSvc, Dhcp, dmserver, 
EventSystem, helpsvc, HidServ, lanmanserver, 
lanmanworkstation, Netman, Nla, Schedule, 
seclogon, SENS, SharedAccess, 
ShellHWDetection, srservice, Themes, TrkWks, 
w32time, winmgmt, wscsvc, WZCSVC 
SVCHOST.EXE 1892 Dnscache 
SVCHOST.EXE 2000 Alerter, LmHosts, SSDPSRV, upnphost, 
WebClient 
SVCHOST.EXE 3524 stisvc 
SVCHOST.EXE 1084 HTTPFilter

One more thing: had a reboot of my computer and it made some strange noise. Usually it's about a second of whirring/fans blowing. This time it sounded more high pitched and didn't sound as powerful.
How about power? I've had my power supply replaced once, but I'm pretty sure my speakers thud every time I turn my room fan (same outlets) on and off.


----------



## Rollin' Rog (Dec 9, 2000)

You still have BITS and Windows Update (wuauserv) running -- so they are not set to disabled as services. To do this you need to run *services.msc*, locate those two services, double click them and set the startup modes to disabled. Or Windows Update can just be disabled through the Security Center panel.

Also this is still showing and it would be nice to know what is starting it:

C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe

These are both related to Microsoft Server.

If you do a "clean boot" following instructions here, do you still see it?

http://support.microsoft.com/default.aspx?scid=kb;EN-US;310353

Be sure to take the option to HIDE all Microsoft services before disabling others

If you had a CD or DVD in the drive when you rebooted -- you may have heard the drive spin up -- it makes a whoosing fan-like sound.

I don't think a power supply problem really explains these symptoms -- you would likely be shutting down or rebooting when

Frankly I would uninstall the Stardock, Webroot and Google applications and try to simply this system as much as possible.


----------



## Daniel0000 (Aug 30, 2004)

Did a clean boot.

Logfile of HijackThis v1.99.1
Scan saved at 1:10:39 PM, on 2/18/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\PRISMSVR.EXE
C:\Program Files\McAfee.com\Personal Firewall\MPFTray.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
c:\program files\mcafee.com\agent\mcagent.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\ups.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\mqsvc.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Outlook Express\msimn.exe
C:\PROGRA~1\INTERNET\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\Daniel\Desktop\Security\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Security\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [MPFEXE] "C:\Program Files\McAfee.com\Personal Firewall\MPFTray.exe"
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\McAgent.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {01CA75F1-054B-4A63-9221-C6926369EC52} (HS_live Control) - http://install.homestead.com/~site/InstallFiles/SIFiles/lpxlive/HS_live.cab
O16 - DPF: {0F9B4CA4-A30F-480A-841D-69B45C50A8F8} - 
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,96/mcinsctl.cab
O16 - DPF: {5AA5A569-F96F-4628-A528-8B3698F558BB} (HS_live Control) - http://install.homestead.com/~site/InstallFiles/SIFiles/lpxlive/HS_live.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab
O16 - DPF: {E856B973-45FD-4559-8F82-EAB539144667} (Dell PC Checkup Installer Control) - 
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)

Simplified the system somewhat.

Image Name PID Services 
========================= ====== =============================================
SVCHOST.EXE 1680 DcomLaunch, TermService 
SVCHOST.EXE 1764 RpcSs 
SVCHOST.EXE 1860 AudioSrv, Browser, CryptSvc, Dhcp, dmserver, 
EventSystem, helpsvc, HidServ, lanmanserver, 
lanmanworkstation, Netman, Nla, Schedule, 
seclogon, SENS, SharedAccess, 
ShellHWDetection, srservice, Themes, TrkWks, 
w32time, winmgmt, wscsvc, WZCSVC 
SVCHOST.EXE 1976 Dnscache 
SVCHOST.EXE 220 Alerter, LmHosts, SSDPSRV, upnphost, 
 WebClient 
SVCHOST.EXE 788 stisvc 
SVCHOST.EXE 3224 HTTPFilter

Still same thing. Spontaneous crashes.
In some games, the colors do strange things. For example, I'll see the main image, and then I'll see a duplicate of the image, but bigger, more transparent and very very spread out. It overlaps and makes a bunch of strange colors. I'll change the in game resolution or anti-aliasing and it generally fixes itself. Other things just do the freeze/sound loop/crash.


----------



## Rollin' Rog (Dec 9, 2000)

Is the computer networked? I see no way from the startups that these two processes (and a few others, frankly,) should be running?

C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe

Some of the gaming anominalies you describe sound like they may be due to card going bad.

I'd like to see another startuplist using the same boot configuration you are currently running (minimal).

For this, download and run Startuplist 2.0 from the link below. Save the log/text and upload that as an attachment. It will be too long for a copy/paste.

http://www.thespykiller.co.uk/forum/index.php?action=tpmod;dl=item3

This should be checked and fixed in the current Scanlog:

O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)

In *services.msc* you can re-enable Automatic Updates service and Background Intelligent Transfer service (BITS) since it has had no effect on the problem.


----------



## Daniel0000 (Aug 30, 2004)

My modem connects to the router. The router connects directly to my computer and wirelessly to the other computers in my household. There are some strange problems with that as well. Usually, when I woke up or got home, the internet would be off, and I would have to power cycle the modem + router. It's not doing that as much any more.

Here's the startuplist.


----------



## Rollin' Rog (Dec 9, 2000)

> Services:
> 
> [NT Services (47)]
> Alerter = C:\WINDOWS\system32\svchost.exe -k LocalService
> ...


If you run *services.msc* can you find the 3 services I've bolded and set their startup modes to "disabled"?

Post a new startup list after doing that and rebooting.


----------



## Daniel0000 (Aug 30, 2004)

There we go.


----------



## Rollin' Rog (Dec 9, 2000)

Has the behaviour of the system improved any with those server type services not starting?

Most of what is left is McAfee related -- although there are still a few services running not normally enabled by default. I don't know what exactly is using them.

(C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\mqsvc.exe
C:\WINDOWS\system32\mqtgsvc.exe)


----------



## Daniel0000 (Aug 30, 2004)

Still crashing randomly. Strange color configurations. That big, widened overlay that turns very yellowish and pixelated. After restarts, random things happen. Explorer closes, or outlook express closes or no programs I select will open, or computer won't reboot normally. After a hard reboot or two everything works, but same problems are occuring.


----------



## Rollin' Rog (Dec 9, 2000)

Well, although there are other things that might be disabled, I think you are almost certainly dealing with a hardware problem. It could be the power supply, the motherboard, or the video card. I think we have tested for ram haven't we?

You might want to have a look at the mobo and see if there are any obvious problems with swollen or leaking capacitors:

http://www.badcaps.net/ident/


----------



## Daniel0000 (Aug 30, 2004)

Did memtest all night with no errors. The power supply has failed before and was replaced.
I'll check the motherboard.


----------

