	[x] Posted via EE Mobile
	Search, ask, and monitor your questions on the go with EE Mobile. Visit Experts Exchange from your mobile device and never be out of touch again.

Question

	[x] Attachment Details

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

8.7

How to fix this? anybody knows if this Is a new Virus,trojan behavior or just my windows corrupt

Asked by VASAF in HijackThis Software, Windows Registry Cleaners, Anti-Spyware

Tags: Microsoft, Win Xp media center, sp2, services.exe - :Application Error The memory cold not be "read"., No Taskbar No Icons conti. Application Errors even in safe mode

Hi there,

Every time I boot my computer I get no taskbar no icons sometimes is black screen sometimes apears my wallpaper only and always I get first this error message: "servises.exe - Application Error: The instruction at '0x0037149c' referenced memory at '0x0113a170'. The memory cold not be 'read'.". The error dialog box gives me the options 'OK' to terminate and 'Cancel to debug'. But by selecting either one system keep bring another similar application errors like Isass.exe, svchost.exe, SAS window:winlogon.exe,logonui.exe,drwtsn32.exe, sometiimes again logonui.exe but the difference is the memory could no be readen and reboot alone The instruction address is always the same and the memory address is same for all application errors at each boot. This is happen even in the safe mode.
sometimes when taskmanager.exe application error appear then if iam lucky the ctrl alt del is working and shows the taskmanager so when type to run : msconfig it shows in the process but not appear in screen the same is happen when i try to run antivirus or other programs so I can't work on the computer
I've already tried the following to solve the problem:
Boot with the cd " Last XP '
- I've tried to restore a pervious windows registry: No success.
- Dr Web cure it found backdoor IRC.nite.18 and clean it: but with restart still getting the error messages.now no infections or spyware found.
- Tested the hard disk all ok
- Tested the memory with three passes of the Memtest86 tool: Memory is OK.

There is the same error messages if I boot the computer in Safe Mode

View the Solution FREE for 30 Days

         
           
             1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119:
120:
121:
122:
123:
124:
125:
126:
127:
128:
129:
130:
131:
132:
133:
134:
135:
136:
137:
138:
139:
140:
141:
142:
143:
144:
145:
146:
147:
148:
149:
150:
151:
152:
153:
154:
155:
156:
157:
158:
159:
160:
161:
162:
163:
164:
165:
166:
167:
168:
169:
170:
171:
172:
173:
174:
175:
176:
177:
178:
179:
180:
181:
182:
183:
184:
185:
186:
187:
188:
189:
190:
191:
192:
193:
194:
195:
196:
197:
198:

           
           
             StartupList report, 14/12/2008, 4:42:59 À¼
StartupList version: 1.52.2
Started from : F:\HiJackThis.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
* Using default options
==================================================
 
Running processes:
 
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\WINDOWS\system32\gearsec.exe
C:\WINDOWS\system32\imapi.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\dwwin.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe
C:\WINDOWS\system32\dwwin.exe
F:\launch.exe
C:\DOCUME~1\Sousana\LOCALS~1\Temp\RarSFX1\_start.exe
C:\DOCUME~1\Sousana\LOCALS~1\Temp\RarSFX1\setup.exe
F:\launch.exe
C:\DOCUME~1\Sousana\LOCALS~1\Temp\RarSFX2\_start.exe
C:\DOCUME~1\Sousana\LOCALS~1\Temp\RarSFX2\setup.exe
F:\HiJackThis.exe
C:\WINDOWS\system32\TASKMAN.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
F:\launch.exe
C:\DOCUME~1\Sousana\LOCALS~1\Temp\RarSFX3\_start.exe
C:\DOCUME~1\Sousana\LOCALS~1\Temp\RarSFX3\setup.exe
 
--------------------------------------------------
 
Checking Windows NT UserInit:
 
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,
 
--------------------------------------------------
 
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
 
NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
NvMediaCenter = RunDLL32.exe NvMCTray.dll,NvTaskbarInit
Cmaudio = RunDll32 cmicnfg.cpl,CMICtrlWnd
NeroFilterCheck = C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
egui = "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
MSConfig = C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
TVTray = C:\PROGRA~1\TVGOA1~1\TVGOA1~1\TVTray.exe
Adobe Reader Speed Launcher = "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
QuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -atboottime
 
--------------------------------------------------
 
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
 
CTFMON.EXE = C:\WINDOWS\system32\ctfmon.exe
Uniblue SpeedUpMyPC = C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe -s
µTorrent = "C:\Documents and Settings\Sousana\Desktop\utorrent.exe"
BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} = "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
 
--------------------------------------------------
 
Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
 
[OptionalComponents]
 = 
 
--------------------------------------------------
 
Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
 
[AdobeUpdater]
 = 
 
--------------------------------------------------
 
Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:
 
Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*
 
Shell & screensaver key from Registry:
 
Shell=Explorer.exe
SCRNSAVE.EXE=*Registry value not found*
drivers=*Registry value not found*
 
Policies Shell key:
 
HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*
 
--------------------------------------------------
 
 
Enumerating Browser Helper Objects:
 
AcroIEHelperStub - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll - {18DF081C-E8AD-4283-A596-FA578C2EBDC3}
(no name) - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
 
--------------------------------------------------
 
Enumerating Task Scheduler jobs:
 
Uniblue SpeedUpMyPC Nag.job
Uniblue SpeedUpMyPC.job
Uniblue SpyEraser.job
 
--------------------------------------------------
 
Enumerating Download Program Files:
 
[QuickTime Object]
InProcServer32 = C:\Program Files\QuickTime\QTPlugin.ocx
CODEBASE = http://www.apple.com/qtactivex/qtplugin.cab
 
[WUWebControl Class]
InProcServer32 = C:\WINDOWS\system32\wuweb.dll
CODEBASE = http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1193069427790
 
[System Requirements Lab Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\sysreqlab2.dll
CODEBASE = http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
OSD = C:\WINDOWS\Downloaded Program Files\SysReqLab2.osd
 
[DivXBrowserPlugin Object]
InProcServer32 = C:\Program Files\DivX\DivX Web Player\npdivx32.dll
CODEBASE = http://download.divx.com/player/DivXBrowserPlugin.cab
 
[{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}]
CODEBASE = http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
 
[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\system32\Macromed\Flash\Flash10a.ocx
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
 
[{D27CDB6E-AE6D-11CF-96B8-444553540001}]
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
 
[AxisMediaControlEmb Class]
InProcServer32 = C:\Program Files\Axis Communications\AXIS Media Control Embedded\AxisMediaControlEmb.dll
CODEBASE = http://81.186.166.196/activex/AMC.cab
 
--------------------------------------------------
 
Enumerating Winsock LSP files:
 
NameSpace #4: C:\WINDOWS\system32\pnrpnsp.dll
NameSpace #5: C:\WINDOWS\system32\pnrpnsp.dll
NameSpace #6: C:\Program Files\Bonjour\mdnsNSP.dll
 
--------------------------------------------------
 
Enumerating ShellServiceObjectDelayLoad items:
 
PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\system32\stobject.dll
UPnPMonitor: C:\WINDOWS\system32\upnpui.dll
WPDShServiceObj: C:\WINDOWS\system32\WPDShServiceObj.dll
 
--------------------------------------------------
End of report, 7.246 bytes
Report generated in 0,047 seconds
 
Command line options:
   /verbose  - to add additional info on each section
   /complete - to include empty sections and unsuspicious data
   /full     - to include several rarely-important sections
   /force9x  - to include Win9x-only startups even if running on WinNT
   /forcent  - to include WinNT-only startups even if running on Win9x
   /forceall - to include all Win9x and WinNT startups, regardless of platform
   /history  - to list version history only

           
         

Attachments:

hijackthis.log (5 KB) (File Type Details)

hijackthis.log

	Title
1	PC infected with spyware / malware
2	Windows XP Pro Operating Eratically
3	Keep getting "The application has faile…
4	Computer Randomly Freezes in XP

How to fix this? anybody knows if this Is a new Virus,trojan behavior or just my windows corrupt

Asked by VASAF in HijackThis Software, Windows Registry Cleaners, Anti-Spyware

Tags: Microsoft, Win Xp media center, sp2, services.exe - :Application Error The memory cold not be "read"., No Taskbar No Icons conti. Application Errors even in safe mode

About this solution