Messages

1

Tech Clinic / Shutdown/Then Restart Problem

« on: March 06, 2005, 08:56:17 PM »

Okay, Avast it will be. And thanks for letting me know that there's a new version of Highjack This. I will do as you say regarding the auto restart. Unfortunately, I have to get ready for some people coming over, so I won't be able to do more on the 'puter today. Will get back on it first thing tomorrow. Talk to you later, and thanks for the help!!!!

2

Tech Clinic / Shutdown/Then Restart Problem

« on: March 06, 2005, 08:39:57 PM »

I was using the AVG7.0 Free Version. Yes, I tried it in safe-made. I have since uninstalled it (and several other programs to simplify my hunt for the possible sourceof the problem), so that's why you don't see it in my running processes. I'm getting ready to install another AV program (either or both Panda and Kapersky) to see what they find.

3

Tech Clinic / Shutdown/Then Restart Problem

« on: March 06, 2005, 02:12:30 PM »

Hi all. I never received any responses on my original post, so I decided to add my "HijackThis" report so maybe someone can help me figure this problem out. Thanks. Bandane

Logfile of HijackThis v1.99.0
Scan saved at 1:05:46 PM, on 3/6/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

4

Tech Clinic / Shutdown/Then Restart Problem

« on: March 05, 2005, 11:33:33 AM »

Hi all. Hope you can help me with this recent problem my system has developed. (System is WinXP Pro, IE 6, with SP-2.) When I connect to _directly_ to IE via my desktop, I get my homepage fine, but after about 3 seconds, the 'puter shuts down and restarts. However, if I connect "indirectly" to the Internet thru one of my several desktop specific-site shortcuts, I don't have any shut down problems. I am not having any problems with OE--email is working fine. The other "anomoly" is that the 'puter also exhibits the same sudden shutdown behavior when I try to run my AVG antivirus program--program runs for about 15 seconds, then the 'puter suddenly shuts down and reboots. (This is the only virus program I have installed.) I can successfully run my Spybot, Ad-Aware, and MS Antispyware programs for spyware/malware, and nothing is detected. I have the "free" version Zone Alarm firewall installed, with the XP firewall turned off. I checked my Event record to see if I could find out what "Event" might be causing this problem, and I see that I am getting various event IDs at different shutdowns, but they all reference that the "database engine stopped". Some of the specific event ID's are 100, 101, 102, 103, 300, 301, & 302. I can post a "Hijack This" log if requested, but I don't see anything on there myself that might be causing this problem. Any help in diagnosing and fixing this problem would be greatly appreciated!! I am on line right now, and can respond back immediately, unless the system totally shuts down on me! Thanks. (PS: Have cable internet connection.)

5

Tech Clinic / "NavExcel Search Toolbar" Program

« on: January 08, 2005, 03:11:43 PM »

Tried RegSeeker program. It couldn't delete/remove the program either. So, I went the regedit route (first time to use--scarry!). Followed your instructions but none of the long strings were for NavExcel Search Toolbar! I just happened to scroll further down the list, and BINGO, there it was! I highlighted it and selected delete. BINGO again, it disappeared from the regedit list! I went to the control panel and looked at Installed Programs List and BINGO yet again, it was no longer on my list!!!!!!! Thank you! Thank you! My mind can rest easy now! Did I say THANK YOU!!!?

6

Tech Clinic / "NavExcel Search Toolbar" Program

« on: January 08, 2005, 11:22:34 AM »

Hi guestolo. Thanks for your response! Okay, I followed your recomendations EXACTLY! 1.)Downloaded CWShredder and it found and fixed a couple of items. Restarted computer. 2.) Checked ADD/REMOVE PROGRAMS list. NavHelper was not, or never was in my programs list, but NavExcel Search Toolbar, my originally reported problem "cosmetic only" program was still on the list. 3.) Did another scan with HijackThis. Put a check next to items you indicated, except your second R1 item, which was not listed on the new scan. Closed all windows and clicked "Fix Checked". Then exited HijackThis. Restarted computer. 4.) Performed Control Panel operations as instructed. 5.) Checked for C:\Program Files\NavExcel Search Toolbar folder with Windows Explorer--was not listed (and wasn't at time of my initial post). 6.)Ran Cleanmgr as instructed. 7.) Installed Ad-Aware, checked for updates (got a few), unchecked "search for negligble risk entries". ran full system scan-one "bug" found and deleted. 8.) Restarted computer. Checked ADD/REMOVE PROGRAMS list--NavExcel Search Toolbar was still listed. 9.) Ran a fresh HijackThis scan. (Log is posted below.) Please hang in there and help me get rid of this "cosmetic" problem!! Thank you very much!!

Logfile of HijackThis v1.99.0
Scan saved at 8:45:28 AM, on 1/8/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\CA\eTrust PestPatrol\PPActiveDetection.exe
C:\Program Files\Webroot\Washer\wwDisp.exe
C:\Program Files\NavNT\defwatch.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Raxco\PerfectDisk\PDSched.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.isp.com
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [eTrustPPAP] "C:\Program Files\CA\eTrust PestPatrol\PPActiveDetection.exe"
O4 - HKCU\..\Run: [Window Washer] C:\Program Files\Webroot\Washer\wwDisp.exe
O4 - HKCU\..\RunServicesOnce: [washindex] C:\Program Files\Washer\washidx.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: ppctlcab - http://ppupdates.ca.com/downloads/scanner/ppctlcab.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://ppupdates.ca.com/downloads/scanner/...r/axscanner.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9DF72003-3911-4735-89BF-A079B4DF8C3A}: NameServer = 68.13.16.30,68.13.16.25
O17 - HKLM\System\CCS\Services\Tcpip\..\{EDF409DC-2F90-4D9D-A280-33EB6CF330F4}: NameServer = 68.13.16.30,68.12.16.30
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = om.cox.net
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = om.cox.net
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = om.cox.net
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Norton AntiVirus Client - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDSched.exe

7

Tech Clinic / "NavExcel Search Toolbar" Program

« on: January 07, 2005, 03:58:02 PM »

I'm not a "Guest". Just forgot to log in before sending my post. Sorry.