# Solved: PC Freezes, gets to many BlueScreens and Drive LED is ON all the time.



## Gunther24 (Oct 17, 2004)

My system is a Dell 4100, w/ 512 MB SRAM, a 40 GB HDD (2 partitions) with Mobile Dock for backup HDD. Running Windows ME
Problems have plagued me for some weeks>
1. The PC FREEZES after 40 to 80 minutes use, cursor immobile and clock stops (battery has been replaced). Has to be RESET. 
2. Blue Screen Errors, 50% recoverable, mostly of the OE and OD 0028 type.
(I have looked at Microsoft's lousy help there- Q308366).
* Occasionally the BSOD is 
*[VMM(1) + 000132CC Error OD:0028:C00142CC
* An exception OE has occurred at 0028:C00139F0 in VxD,
Called from 0028:C1B5142B

(Six weeks ago I paid MS $35 for their support help, with the spec that they tell me what the list of OE and OD errors I sent them meant and where they pointed to. They could not solve that, telling me that only a MS Development Engineer had the tools. I got my $35 back.)

3. Occasionally, when "recovering from a BSOD" I get a Black Screen with a 
line of vertical GREEN lines at the top ||||||||||||||||.
A few time, at FREEZE time, that Green line is superimposed on my Eudora Screen.

Freezes can occur at any time: while the Desktop shows and the PC is not owrking. while typing something like this. Seems time (?) or system fail related.
After a FREEZE, I can RESET and go on working for 40-80 minutes again

I have unchecked most of the Startup list, which I control with Code Stuff's
"Starter5.61", which over rules msconfig /Startup\ and is more convenient.

Exported list: * = checked; all others unchecked
Item,Value,Section
*StateMgr,C:\WINDOWS\System\Restore\StateMgr.exe,"Registry - Machine RunServices"
"Adobe Gamma Loader.lnk","C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe ","Startup - Current User"
ClipMate6,"C:\Program Files\ClipMate6\ClipMt63.exe","Registry - User Run"
ClipMate6,"C:\Program Files\ClipMate6\ClipMt63.exe","Registry - Def User Run"
ctfmon.exe,ctfmon.exe,"Registry - User Run"
ctfmon.exe,ctfmon.exe,"Registry - Def User Run"
"EPSON Background Monitor.lnk","C:\ESM2\Stms.exe ","Startup - Current User"
Eudora611,C:\Eudora611\Eudora.exe,"Registry - User Run"
Eudora611,C:\Eudora611\Eudora.exe,"Registry - Def User Run"
LoadPowerProfile,"Rundll32.exe powrprof.dll,LoadCurrentPwrScheme","Registry - Machine Run"
LoadPowerProfile,"Rundll32.exe powrprof.dll,LoadCurrentPwrScheme","Registry - Machine RunServices"
MDM7,"""C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\VS7DEBUG\MDM.EXE""","Registry - Machine RunServices"
MOSearch,C:\PROGRA~1\COMMON~1\SYSTEM\MOSEARCH\BIN\MOSEARCH.EXE,"Registry - Machine RunServices"
*NewShortcut2.lnk,"C:\Program Files\Myalert\Myalert.exe QuickCheck","Startup - Current User"
*PCCClient.exe,"""C:\Program Files\Trend Micro\PC-cillin 2003\PCCClient.exe""","Registry - Machine Run"
*pccguide.exe,"""C:\Program Files\Trend Micro\PC-cillin 2003\pccguide.exe""","Registry - Machine Run"
*PCCIOMON.exe,"""C:\Program Files\Trend Micro\PC-cillin 2003\PCCIOMON.exe""","Registry - Machine Run"
*PCCIOMON.exe,"""C:\Program Files\Trend Micro\PC-cillin 2003\PCCIOMON.exe""","Registry - Machine RunServices"
*PccPfw,"C:\Program Files\Trend Micro\PC-cillin 2003\PccPfw.exe","Registry - Machine RunServices"
*PCHealth,"C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s","Registry - Machine Run"
*Pop3trap.exe,"""C:\Program Files\Trend Micro\PC-cillin 2003\Pop3trap.exe""","Registry - Machine Run"
*ScanRegistry,"C:\WINDOWS\scanregw.exe /autorun","Registry - Machine Run"
SchedulingAgent,mstask.exe,"Registry - Machine RunServices"
*SSDPSRV,C:\WINDOWS\SYSTEM\ssdpsrv.exe,"Registry - Machine RunServices"
*SystemTray,SysTray.Exe,"Registry - Machine Run"
TaskMonitor,C:\WINDOWS\taskmon.exe,"Registry - Machine Run"
*tmproxy,"C:\Program Files\Trend Micro\PC-cillin 2003\tmproxy.exe","Registry - Machine RunServices"
Wintask,winlog.exe,"Registry - Machine Run"
Wintask,winlog.exe,"Registry - Machine RunOnceEx"
Wintask,winlog.exe,"Registry - Machine RunServices"
Wintask,winlog.exe,"Registry - Machine RunServicesOnce"

Things tried:
A> A couple of weeks ago, I swapped HDD, removing the original Dell Seagate 20GB drive and put in a new WD400. Then, I ran for several days without any problems. But the same headaches came back.

B> I also tried to run with my DSL line unplugged and the AV program not loaded. NO effect.

C> I ran DELL's Diagnostic for the system, which in the extended mode took about 3-4 hours. Quick Test = 9 minutes. All comes out with PASS.

D> I have run SCANDISK innumerable times and defragged the C:\

E> in the SAFE MODE, I seem to be able to run longer than the usual 40-80 minutes before a freeze. (Not 100% certain that, but it seems I can let the system stay ON, with the SAFE MODE screen showing and there is no freeze.
[I run Scandisk and Defrag from the SAFE MODE only, so that they finish without endless restarting].

I have run out of ideas, except to reseat the processor and check the cooling system. 
*** I have scanned the quite a bit of the archives***
If anyone has any ideas, I would welcome them.
I may be off line now and then to RESET, after a freeze.


----------



## JSntgRvr (Jul 1, 2003)

Switch the memory modules around. The one in bay 1 to bay 2, the one in bay2 to bay1 and so forth. Most page faults, Freeze and Windows protection error are due to faulty memory modules.

Also, Right click My computer icon. Select Properties, then select the performance tab. Click on Graphics. Move the graphics slider one notch to the left. That will slow down your graphics, but will help you resolve must page faults and exceptions errors.


----------



## Gunther24 (Oct 17, 2004)

Thanks. Did Item 2 right away.
Re-affirmed the fact that in the SAFE MODE, the PC stays active for 6+ hours without freezing (I shut it down after that).
Suggests that the problem is software related.

It is just maddening that MS puts out the BSODs without a means for determining what they mean or where they point.


----------



## ~Candy~ (Jan 27, 2001)

Hi and welcome. That really doesn't confirm that it's software related, since in safe mode, most hardware drivers do not load.


----------



## JSntgRvr (Jul 1, 2003)

Download and run the following programs:

CWShredder

http://www.majorgeeks.com/download4086.html

Spybot Search and Destroy (Update the definitions prior to the scan)

http://spybot.eon.net.au/en/download/index.html

Adaware (Update the definitions prior to the scan)

http://www.lavasoftusa.com/support/download/

HijackThis (Run this program only to obtain a log of your running processes)

http://www.majorgeeks.com/download3155.html

After running these programs and eliminating all spyware and adware found, post the HijackThis log in a Reply and let us take a look at it.


----------



## Gunther24 (Oct 17, 2004)

AcaCandy's comment is probably correct, especially when I lookat the BSODs which say "...An exception OE has occurred at 0028:C00139F0 in VxD.
..called in from 0028:C1B5142B"

What happens I disable allthe VxD on the list in msconfig? Don't I need those drivers
to do many things during PC operation?

I have the following items in the VxD list (msconfig): Which can be unchecked ???
VNetsup.Vxd
Ndis.vxd
javasup.vxd
VNetbios.vxd
VRedev.vxd
DFS.vxd
LMouse.vxd
MDISWAN.vxd
mrtRate.vxd (in Win\System\)
Symevnt.vxd
Vserver.vxd
Ontracks.386
ICSHAREP.vxd


----------



## JSntgRvr (Jul 1, 2003)

VXDs in Msconfig????????? Run HijackThis and let us take a look at your running processes.


----------



## Gunther24 (Oct 17, 2004)

VxD list in System Configuration Utility which you get by running msconfig.
I run Spybot and Adaware regularly, along with manual virus scans with TrendMicro's 
PC-cillin, updated regularly.

Logfile of HijackThis v1.98.2
Scan saved at 5:14:00 PM, on 10/18/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\EUDORA611\EUDORA.EXE
C:\PROGRAM FILES\TREND MICRO\PC-CILLIN 2003\PCCIOMON.EXE
C:\PROGRAM FILES\TREND MICRO\PC-CILLIN 2003\PCCPFW.EXE
C:\PROGRAM FILES\TREND MICRO\PC-CILLIN 2003\TMPROXY.EXE
C:\PROGRAM FILES\TREND MICRO\PC-CILLIN 2003\PCCCLIENT.EXE
C:\PROGRAM FILES\TREND MICRO\PC-CILLIN 2003\PCCGUIDE.EXE
C:\PROGRAM FILES\TREND MICRO\PC-CILLIN 2003\POP3TRAP.EXE
C:\PROGRAM FILES\CLIPMATE6\CLIPMT63.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\OPERA723\OPERA.EXE
C:\PROGRAM FILES\OPERA723\OPERA.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://server224.smartbotpro.net/7search/?hkcu
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://server224.smartbotpro.net/7search/?hklm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://keyword.netscape.com/keyword/%s
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: ShopSafe Browser Helper Object - {333F6B96-3992-4D58-A499-145A10FE48C3} - C:\WINDOWS\SYSTEM\BHOSSAFE.DLL
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - (no file)
O3 - Toolbar: (no name) - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - (no file)
O3 - Toolbar: @msdxmLC.dll,[email protected],&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PC-cillin 2003\PCCClient.exe"
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\PC-cillin 2003\pccguide.exe"
O4 - HKLM\..\Run: [PCCIOMON.exe] "C:\Program Files\Trend Micro\PC-cillin 2003\PCCIOMON.exe"
O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2003\Pop3trap.exe"
O4 - HKLM\..\Run: [PCDRealtime] C:\WINDOWS\realtime.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [PCCIOMON.exe] "C:\Program Files\Trend Micro\PC-cillin 2003\PCCIOMON.exe"
O4 - HKLM\..\RunServices: [PccPfw] C:\Program Files\Trend Micro\PC-cillin 2003\PccPfw.exe
O4 - HKLM\..\RunServices: [tmproxy] C:\Program Files\Trend Micro\PC-cillin 2003\tmproxy.exe
O4 - Startup: NewShortcut2.lnk = C:\Program Files\Myalert\Myalert.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE10\EXCEL.EXE/3000
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra button: Dell Home - {90D7162F-5C08-4A00-B04B-6A5197462544} - http://www.dellnet.com (file missing) (HKCU)
O9 - Extra button: Netnews - {A1FA67A2-156D-4C5D-8A37-FB5AA267D521} - news:worldnet.help.new-users (file missing) (HKCU)
O16 - DPF: {CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_01) - 
O16 - DPF: {CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_03) - 
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_01) -


----------



## ~Candy~ (Jan 27, 2001)

I'm thinking bad ram.


----------



## Gunther24 (Oct 17, 2004)

AcaCandy: I had run Dell's Diagnostic for the Dimension 4100, both Quick and Extended. Under System Memory it came up with PASS for "Memory Data Line Test"
for two devices. Sysem Memory - Memory Bit Coupling Test = PASS
Also PASS for L1 and L2 Data Cache Pattern Tests. 
All itmes were PASS.


----------



## Gunther24 (Oct 17, 2004)

TO JSntgRvr: I will take your suggestions about the memory modules.
As a matter of fact for the second time in three years, Dell came up with a potential usable suggestion: Reseat the processor, Heatsink, and Memory modules.

I will do that in the morning - getting a bit tired now.

By the way, hardly any BSODs today, but the PC freezes every 50-80 minutes, like clockwork, when booted normally.
*** Even thought the HDD drive light haseemed to have gone back to normal,
i.e. NOT on all the time, it reverted yesterday, and stays ON.

Anybody know what controls the drive light when there is not INPUT from the mouse or KB?
QUESTION:
Anything show up on the Hijackthis LOG ???? (I cannot tell what should not be there)
question:
How about the VxD files List? anything that can be safely unchecked??

Thanks for all the effort so far.


----------



## ~Candy~ (Jan 27, 2001)

I've had ram pass all tests and still not work in said computer.

Drive LED may point to a failing hard drive....I guess that is a possibility..............


----------



## Gunther24 (Oct 17, 2004)

10/19/04 morning: Last night, I went to msconfig ->System Configuration Utility, checked [v] selective startup and UNCHECKED the VxD item. 
This left me without a Network connection, printing and other capabilities, BUT my PC stayed alive without freezing for >12 hours.

Now can anyone tell me which of the VxDs in the list (3:58pm yesterday) and below
can be unchecked without a problem to using my PC and the Internet?
I have the following items in the VxD list (msconfig): Which can be unchecked ???
What does each of these mean / do ??
VNetsup.Vxd
Ndis.vxd
javasup.vxd
VNetbios.vxd
VRedev.vxd
DFS.vxd
LMouse.vxd
MDISWAN.vxd
mrtRate.vxd (in Win\System\)
Symevnt.vxd
Vserver.vxd
Ontracks.386
ICSHAREP.vxD


----------



## ~Candy~ (Jan 27, 2001)

VNetsup.Vxd
Ndis.vxd
VNetbios.vxd


I believe those 3 are a must.


----------



## JSntgRvr (Jul 1, 2003)

Have HijackThis fix this:

O4 - HKLM\..\Run: [PCDRealtime] C:\WINDOWS\realtime.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra button: Netnews - {A1FA67A2-156D-4C5D-8A37-FB5AA267D521} - news:worldnet.help.new-users (file missing) (HKCU)

The VXDs are the Virtual Device Drivers that allow your programs to communicate with the Devices installed in your computer such as, Video, Audio, printers, scanners, PCMIA Network Card,.... etc. You can't Fidle with these drives as your VMM32.VXD could become corrupted.

It seems that some of these drivers may have became currupted. Here is a link with information abour the VMM32.VXD. You may have to rebuild this file:

http://www.easydesksoftware.com/news/news10.htm

http://freepctech.com/articles/articles.php?ArticleId=49

It is not an easy task. If you are using a Dell, the installation files are located in C:\Windows\Options\Install.


----------



## Gunther24 (Oct 17, 2004)

TO JSntgRvr: I have done a number of things incuding fixing what you suggested.
I have also reseated the Memory miodules (actually switched them),
reseated the CPU ( with fresh heat transfer compound bor the "radiator" and cleaned up the fan of dust ( it is running quietly.
I have also gone back and summarized all the observations, which I will add in a separate message.
Any more suggestions are welcome.

Here is the new Highjackthis.log file:
Logfile of HijackThis v1.98.2
Scan saved at 3:33:27 PM, on 10/23/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\PROGRAM FILES\TREND MICRO\PC-CILLIN 2003\PCCIOMON.EXE
C:\PROGRAM FILES\TREND MICRO\PC-CILLIN 2003\PCCPFW.EXE
C:\PROGRAM FILES\TREND MICRO\PC-CILLIN 2003\TMPROXY.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\TREND MICRO\PC-CILLIN 2003\PCCCLIENT.EXE
C:\PROGRAM FILES\TREND MICRO\PC-CILLIN 2003\PCCGUIDE.EXE
C:\PROGRAM FILES\TREND MICRO\PC-CILLIN 2003\POP3TRAP.EXE
C:\WINDOWS\SYSTEM\CTFMON.EXE
C:\WINDOWS\DESKTOP\PC-CLEANUP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://server224.smartbotpro.net/7search/?hkcu
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://server224.smartbotpro.net/7search/?hklm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://keyword.netscape.com/keyword/%s
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: ShopSafe Browser Helper Object - {333F6B96-3992-4D58-A499-145A10FE48C3} - C:\WINDOWS\SYSTEM\BHOSSAFE.DLL
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - (no file)
O3 - Toolbar: (no name) - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - (no file)
O3 - Toolbar: @msdxmLC.dll,[email protected],&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PC-cillin 2003\PCCClient.exe"
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\PC-cillin 2003\pccguide.exe"
O4 - HKLM\..\Run: [PCCIOMON.exe] "C:\Program Files\Trend Micro\PC-cillin 2003\PCCIOMON.exe"
O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2003\Pop3trap.exe"
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [PCCIOMON.exe] "C:\Program Files\Trend Micro\PC-cillin 2003\PCCIOMON.exe"
O4 - HKLM\..\RunServices: [PccPfw] C:\Program Files\Trend Micro\PC-cillin 2003\PccPfw.exe
O4 - HKLM\..\RunServices: [tmproxy] C:\Program Files\Trend Micro\PC-cillin 2003\tmproxy.exe
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: Dell Home - {90D7162F-5C08-4A00-B04B-6A5197462544} - http://www.dellnet.com (file missing) (HKCU)
O16 - DPF: {CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_01) - 
O16 - DPF: {CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_03) - 
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_01) -


----------



## Gunther24 (Oct 17, 2004)

Summary of my observations and actions formy problem of
PC Problems (recap) with actions todate: 10/23/04 3:50 PM

Dell 4100 Running Windows ME 
1. System FREEZES every 40-80 minutes. On RESET, I can continue
* Cursor and Clock immobile, keyboard inactive. (Battery replaced: ok).
Not related to any specific activity - will happen if the PC sits inactive with the 
Desktop showing.

*** On occasion, the PC RESETS itself spontaneously in the middle of typing, or when hitting ENTER after a BSOD, or when clicking on a program or menu.

**** Occasionally, the screen will go to BLACK with a GREEN stripe of ~ 1/4 in 
vertical lines across the top } |||||||||||||||||||||||||||||||||||||||||||||||||||. 
I have also seen the green stripe across the top of the Eudora screen when the system froze and I hit ENTER.

**** The system generates a huge number of lost file fragments when running SCANDISK. On 10/21/04, I collected 61 items, FILE00xx.CHK, which varied from 8 K to 4.2 MB.
I have examined a bunch and they vary from having no characters present to
items titled "Microsoft Search Gatherer Transaction Log", to no characters present,
to list of programs, machine language, one or two characters separated by ........ etc.
(Examined with ZTREE, V (view), which display the content of any file)

2. The HDD drive light, showing that it is active/being accessed, 
is ON most of the time.
On occasion, on booting, it will be normal, ie. it is on only when keyboard or mouse initiate action = Normal.
The HDD drive LED will also stay on when the system is booted from a Win ME Startup FD, going to minimal boot (4). Nothing loaded !!

3. Too many Blue screen errors (BSOD), many are recoverable.
Some come between the sound telling me that the desktop is being loaded, before
icons appear.

Most Errors are OE and OD 0029:xxxxxxxx, but not all.
Some errors are VMM(01) + xxxxxxx plus OE:0028:xxxxxxxxxx
or 06:0000: 00000FA , IFSMgr(1)+00003FA6......
***** 95+% of the errors have been logged.
[I paid Microsoft [MS] to tell me what the Blue Screen errors were, how to interpret them and where each pointed to: Support told me that required a MS Development Engineer. They refunded my $35]

Things that have been done and checked:
* The four LEDs on the back of the DELL are GREEN = Normal, no problems
**SCANDISK is run whenever there have been 2 or 3 BSODs; usually every day or two, 
or even more than once a day. It is run from SafeMode, because it rarely finishes from
the Windows screen.
**The system has been defragmented at least once a month, or more often recently.
*** I have run RegShot and RegClean to make sure the REGISTRY is clean, when ever I deleted some programs not in use, in recent days.
***
*** Anti-virus program (TrendMicro PCC-Cillin is up-to-date and a manual scan is run 
regularly. No viruses received and deleted/quarantined since 8/26/04.
*** Spybot and Adaware are run regularly and all files found are deleted.
[ Dell recommended <Pest control> from Sunbelt software for spy programs found
things that were not on the disk!!]
*****The operating system has been re-installed three times: 
Recovery Reinstall from a MS provided CD. Most recently on 10/3/04

** Checked: Do not run Scandisk after a bad shut down, since it would rarely complete in Windows.

FREEZEs occur even with DSL unplugged and AV program not loaded.

10/5: PC operational without FEEZE for 15 hours while in SAFE MODE

[PC reported that WD400-2 had 580MB of data with 16 GB free, wheres it really had about 8 GB data, the copy of partition 1. Did not recurr in a subsecquent update.]

Suspected a faulty hard drive and switched drives for C:\, while the FD was also replaced. After that, the PC ran without errors or freezes for 3 days. Then it went back to old habits (10/5 to 10/9)
[ FD drive has been replaced, because it wrecked FDs, as judged by Checkdisk
before and after writing to a new FD. New drive works properly.]

On two occasions, the PC booted to a strange Desktop. It had only a few ICONS with two never seen before (10/10/04). RESET -> normal Desktop.

1. I am on selective startup, because there have been some errors called from VxD.
Only 6 items suggested by Microsoft [MS] and Dell have been checked

Items in the VxD list (msconfig): [Items Checked: 10/19-23/04 ]
x VNetsup.Vxd
x Ndis.vxd
x javasup.vxd
x VNetbios.vxd
x VRedir.vxd
x DFS.vxd
LMouse.vxd
MDISWAN.vxd
mrtRate.vxd (in Win\System\)
Symevnt.vxd
Vserver.vxd
Ontracks.386
ICSHAREP.vxd
It seems to make little difference to the problems listed.

Running Tasks 10/23/04: [Note- Kernel32 on a previous day was present 3x, vs 5x today??]

System Tool - System Information - Tools - Software Env. - Running Tasks 10/23-04

clipmate.exe	c:\program files\clipmate6\clipmate.exe	0xfffb6daf	32	Not Available	Not Available	Not Available	6.5.1.520	2.56 MB (2,686,976 bytes)	10/23/2004 9:46:56 AM
ctfmon.exe	c:\windows\system\ctfmon.exe	0xfffa4f73	32	Not Available	Not Available	Not Available	1.00.2409.7 built by: Lab06_N	8.00 
KB (8,192 bytes)	02/20/2001 1:09:54 PM
ddhelp.exe	c:\windows\system\ddhelp.exe	0xfff8dff7	256	Not Available	Not Available	Not Available	4.09.00.0900	32.00 KB (32,768 bytes)	07/19/2004 8:09:58 PM
explorer.exe	c:\windows\explorer.exe	0xfffd8bff	32	Not Available	Not Available	Not Available	5.50.4134.100	220.00 KB (225,280 bytes)	08/15/2004 12:23:18 PM
helpctr.exe	c:\windows\pchealth\helpctr\binaries\helpctr.exe	0xfff98af7	32	Not Available	Not Available	Not Available	4.90.0.2525	484.27 KB (495,888 bytes)	08/15/2004 12:26:12 PM
kernel32.dll	c:\windows\system\kernel32.dll	0xffcfd6db	128	Not Available	Not Available	Not Available	4.90.3000	524.00 KB (536,576 bytes)	08/15/2004 12:25:28 PM
kernel32.dll	c:\windows\system\kernel32.dll	0xffff833f	32	Not Available	Not Available	Not Available	4.90.3000	524.00 KB (536,576 bytes)	08/15/2004 12:25:28 PM
kernel32.dll	c:\windows\system\kernel32.dll	0xfffd945f	32	Not Available	Not Available	Not Available	4.90.3000	524.00 KB (536,576 bytes)	08/15/2004 12:25:28 PM
kernel32.dll	c:\windows\system\kernel32.dll	0xfffba4eb	32	Not Available	Not Available	Not Available	4.90.3000	524.00 KB (536,576 bytes)	08/15/2004 12:25:28 PM
kernel32.dll	c:\windows\system\kernel32.dll	0xfffc6e3b	32	Not Available	Not Available	Not Available	4.90.3000	524.00 KB (536,576 bytes)	08/15/2004 12:25:28 PM
mprexe.exe	c:\windows\system\mprexe.exe	0xffffa3bf	32	Not Available	Not Available	Not Available	4.90.3000	28.00 KB (28,672 bytes)	08/15/2004 12:26:15 PM
pccclient.exe	c:\program files\trend micro\pc-cillin 2003\pccclient.exe	0xfffcc413	32	Not Available	Not Available	Not Available	10.0.5.1142	708.07 KB (725,064 bytes)	09/16/2003 3:59:42 PM
pccguide.exe	c:\program files\trend micro\pc-cillin 2003\pccguide.exe	0xfffbcd53	32	Not Available	Not Available	Not Available	10.0.5.1142	632.07 KB (647,238 bytes)	09/16/2003 4:08:50 PM
pcciomon.exe	c:\program files\trend micro\pc-cillin 2003\pcciomon.exe	0xfffe98db	32	Not Available	Not Available	Not Available	10.0.5.1142	256.00 KB (262,144 bytes)	09/16/2003 4:00:04 PM
pccpfw.exe	c:\program files\trend micro\pc-cillin 2003\pccpfw.exe	0xfffeaeef	32	Not Available	Not Available	Not Available	10.0.5.1142	632.06 KB (647,234 bytes)	09/16/2003 4:00:36 PM
pop3trap.exe	c:\program files\trend micro\pc-cillin 2003\pop3trap.exe	0xfffbea7f	32	Not Available	Not Available	Not Available	10.0.5.1142	552.07 KB (565,318 bytes)	09/16/2003 4:04:42 PM
spool32.exe	c:\windows\system\spool32.exe	0xffff8b47	32	Not Available	Not Available	Not Available	4.90.3000	44.00 KB (45,056 bytes)	08/15/2004 12:26:19 PM
ssdpsrv.exe	c:\windows\system\ssdpsrv.exe	0xfffe979b	32	Not Available	Not Available	Not Available	4.90.3003.0	55.77 KB (57,104 bytes)	12/22/2001 10:18:25 AM
stmgr.exe	c:\windows\system\restore\stmgr.exe	0xfffc55cb	32	Not Available	Not Available	Not Available	4.90.0.2533	60.27 KB (61,712 bytes)	08/15/2004 12:26:20 PM
systray.exe	c:\windows\system\systray.exe	0xfffb568b	32	Not Available	Not Available	Not Available	4.90.3000	36.00 KB (36,864 bytes)	08/15/2004 12:26:20 PM
taskmon.exe	c:\windows\taskmon.exe	0xfffb134b	32	Not Available	Not Available	Not Available	4.90.3000	28.00 KB (28,672 bytes)	08/15/2004 12:26:21 PM
tmproxy.exe	c:\program files\trend micro\pc-cillin 2003\tmproxy.exe	0xfffd528f	32	Not Available	Not Available	Not Available	10.0.5.1142	272.07 KB (278,598 bytes)	09/16/2003 4:09:02 PM
winmgmt.exe	c:\windows\system\wbem\winmgmt.exe	0xfff73fff	32	Not Available	Not Available	Not Available	1.50.1164.0000	192.08 KB (196,685 bytes)	08/15/2004 12:26:24 PM
wmiexe.exe	c:\windows\system\wmiexe.exe	0xfffb1a6b	32	Not Available	Not Available	Not Available	4.90.2452.1	16.00 KB (16,384 bytes)	08/15/2004 12:26:24 PM
-------------------------------------------------------------------------------------------------------------

On advice of DELL - Support (usually useless 99% of the time) I have
A> Run the DELL Dimension 4100 Diagnostics from their CD: All PASS

B> Reseated the Memory modules (SRAM). Actually switched the 2 in position.
C> Reseated the CPU ( used fresh heat sink compound), 
cleaned the "radiator" and fan assembly, which is working quietly.


----------



## ~Candy~ (Jan 27, 2001)

Did you run a drive diagnostic program on the hard drive. The LED light staying on is sometimes the indication of a failing drive.


----------



## JSntgRvr (Jul 1, 2003)

There is nothing in the log that should be responsible for this behavior. Do yourself a favor. Run Msconfig and disable the Antivirus Programs. These are as follows:

O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PC-cillin 2003\PCCClient.exe"
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\PC-cillin 2003\pccguide.exe"
O4 - HKLM\..\Run: [PCCIOMON.exe] "C:\Program Files\Trend Micro\PC-cillin 2003\PCCIOMON.exe"
O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2003\Pop3trap.exe"
O4 - HKLM\..\RunServices: [PCCIOMON.exe] "C:\Program Files\Trend Micro\PC-cillin 2003\PCCIOMON.exe"
O4 - HKLM\..\RunServices: [PccPfw] C:\Program Files\Trend Micro\PC-cillin 2003\PccPfw.exe
O4 - HKLM\..\RunServices: [tmproxy] C:\Program Files\Trend 
Micro\PC-cillin 2003\tmproxy.exe

Do not fix them thru HijackThis, but rather throughout Msconfig. Test you computer without these entries and let us know the results.


----------



## Gunther24 (Oct 17, 2004)

TO AcaCandy: I replaced the original Seagte 20 GB drive from Dell early on with a brand new WD-400, because I suspected the drive, after finding that the battery etc. were ok.. The benefit was very temporary. a few days without a problem.
The Seagate drive is now in a Mobile Dock and is a perfectly fine backup HDD, which is normally OFF.

To JSntgRvr: I have repeatedly run with the DSL disconnected and the 7 TrendMicro files NOT LOADED. (I contrl my Startup programs with a small program from Code Stuff: Starter 5.61, which overrules the msconfig Startup list.

That too had no effect. The FREEZEs occurr anyway.


----------



## JSntgRvr (Jul 1, 2003)

You are using programs that I am not familiar with. So the assurance that the running processes are in place and not in conflict confuses me. Some of the errors you have received deals with static .vxd files. It only tells me that a device in your computer may be in conflict.

Troubleshooting static .vxd files:

To determine if the problem is being caused by virtual device driver(.vxd) files you will need to test these:

Restart your computer, and while your computer restarts, press and hold CTRL until the Windows 98 Startup menu appears.

Choose Step By Step Confirmation, and then press ENTER.

Press Y when you receive each of the following prompts, and press N for all other prompts:

- Load Doublespace driver 
- Process the system registry 
- DEVICE=C:\WINDOWS\HIMEM.SYS 
- DEVICE=C:\WINDOWS\IFSHLP.SYS 
- Load the Windows graphical user interface 
- Load all Windows drivers 

After all Windows drivers are loaded, you are prompted to load all static .vxd files, one at a time. Note each static .vxd file name, and respond with "No" to avoid loading each file. The following list is a partial list of Microsoft static .vxd files: 

+-----------------------------------------+
| Static .vxd file | Provides support for | 
+-----------------------------------------+
| Vnetsup.vxd | Microsoft Networking | 
+-----------------------------------------+
| Ndis.vxd | Microsoft Networking | 
+-----------------------------------------+
| Ndis2sup.vxd | Microsoft Networking | 
+-----------------------------------------+
| Javasup.vxd | Microsoft Java | 
+-----------------------------------------+
| Vrtwd.386 | Clock | 
+-----------------------------------------+
| Vfixd.vxd | Video Phone helper | 
+-----------------------------------------+
| Vnetbios.vxd | Microsoft Networking | 
+-----------------------------------------+
| Vserver.vxd | Microsoft Networking | 
+-----------------------------------------+
| Vredir.vxd | Microsoft Networking | 
+-----------------------------------------+
| Dfs.vxd | Microsoft Networking | 
+-----------------------------------------+
| Ndiswan.vxd | Microsoft Networking | 
+-----------------------------------------+
| Msmouse.vxd | Microsoft Mouse | 
+-----------------------------------------+

Test your computer. If your computer do not freeze, define the problem further by repeating the above steps, but respond with "Yes" to only one of the files in the list above. Test each file by restarting your computer and responding "Yes" to a different file each time. If the error reoccurs, the issue is related to the last static .vxd file you selected.

Check the properties of the incompatible static .vxd file to determine the program with which it is associated. Uninstall and then reinstall the program to replace the .vxd file with a new copy of the file.

Some of the errors you mention in the thread relates to the C:\WINDOWS\IFSHLP.SYS . The question is, Would replacing this file with a fresh copy resolve the issue? Was the last installation a clean install?

In your position I would also disable the devices one by one in the Device Manager, as they may represent the cause. These are the Video Adapter, Audio Adapter, CD_ROM, DVD, .... and so forth. If by disabling one of these devices the issue is resolved, then we will know what is the cause of the issue, and will reinstall the drivers as an option, or replace the device.

I find no other options to deal with this issue.


----------



## Gunther24 (Oct 17, 2004)

This problem was resolved by installuing Windows 2000 Pro in partition D:\
and i re-installing all the programs. Resized partition C:\ to minimal size.
Quit using the worst ever OS since DOS 2.0.

Completed


----------



## berry4558 (Oct 20, 2004)

Hi!! I had the same problem above mentioned and followed all of your instructions, I have a copy of my hijackthis and would like to see if you can take a look at it and tell me what I need to do. Thank you in advance for your help.

Deloris
Logfile of HijackThis v1.99.1
Scan saved at 12:11:13 PM, on 7/19/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\snmp.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\PROGRA~1\Magentic\bin\MgApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\INCRED~1\bin\ImApp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\INCRED~1\bin\IncMail.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Delores\Local Settings\Temp\wzbd40\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [Magentic] C:\PROGRA~1\Magentic\bin\Magentic.exe /c
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} - http://a516.g.akamai.net/f/516/25175/7d/runaware.download.akamai.com/25175/citrix/wficat-no-eula.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://nicolette1958.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1155955458419
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: acaptuser32.dll C:\PROGRA~1\Google\GO333C~1\GOEC62~1.DLL
O20 - Winlogon Notify: WgaLogon - WgaLogon.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: GoogleDesktopManager - Unknown owner - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SQL Server (MSSMLBIZ) (MSSQL$MSSMLBIZ) - Unknown owner - c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sMSSMLBIZ (file missing)


----------



## Blue Zee (May 18, 2007)

berry4558 said:


> I have a copy of my hijackthis and would like to see if you can take a look at it ...


Post your log here:

http://forums.techguy.org/54-security/

I'm sure the experts will help you there.

Be patient they usually are a bit busy.

Zee


----------

