Outlook 2007 closes with no warning and no errors ...
I upgraded to Office 2007 a couple of months ago. Not sure when this started, but probably a couple of weeks ago or so, Outlook 2007 started closing with no warning and no errors every 1-2 days or so (I usually have the PC on 24/7). I typically will have several Outlook windows open at the same time, and I'll go to do something innocuous in one of them, and all of the windows will close. Checking Event Viewer, I see things like (not sure if this is related because I checked Event Viewer sometime later and wasn’t sure if these were from the time of the crash or not):
Event Type: Error
Event Source: Microsoft Office 12
Event Category: None
Event ID: 1000
Date: 3/22/2007
Time: 8:51:33 AM
User: N/A
Computer: JSMITH
Description:
Faulting application outlook.exe, version 12.0.4518.1014, stamp 4542840f, faulting module ntdll.dll, version 5.1.2600.2180, stamp 411096b4, debug? 0, fault address 0x00011e58.
...
And this more frequently ...
Event Type: Error
Event Source: Microsoft Office 12
Event Category: None
Event ID: 5000
Date: 3/27/2007
Time: 3:57:21 PM
User: N/A
Computer: JSMITH
Description:
EventType office12asserttimer, P1 p1ml, P2 12.0.4518.0, P3 5, P4 515, P5 NIL, P6 NIL, P7 NIL, P8 NIL, P9 NIL, P10 NIL.
...
Unless I find a solution sooner, I'll try to pay more attention in the future to which Events are the most current at the time of Outlook closing and provide that info here, but I've also got other issues going on, too - not sure if they are related so I'll just mention some in passing in case they might be:
- Oftentimes (but not always), when I press Send on an email, I’ll notice the Outlook Status bar says “Sending 1 of 4 emails” when there should only be one being sent (I am familiar with Outlook sometimes queuing unsent emails in the Outbox if something interrupts their transmission but I don’t think is happening here; further, when I check the Sent folder after this happens, only the email I just sent is present within the recent time frame [again, I know that “Sent” emails can end up in other folders, too, but don’t believe this is the case here). Further, this anomaly always says “Sending 1 of 4 emails” (not some other number of “phantom” emails…).
- Just recently, I had the experience of looking for some information I was sure I had updated in one of my Outlook Contacts but it wasn’t there so I a did a Windows Desktop Search for the data and WDS found the information, in an Outlook Contact of the SAME name, but whose location was reported as “Personal Folders/Inbox” (there is only ONE such named Contact in my Contacts folder and it did NOT reflect the updated information, although this one found by WDS DID). Clarifying further, WDS found 3 versions of the Contact: a) one WITH the updated information and a location of “Personal Folders/Inbox”; b) another withOUT the updated information and a location of “Personal Folders/Contacts”; and c) another (earlier version) of the Contact with the same name and a location of “personal folders/inbox” (lower case this time). I guess I’m surprised as to WDS’s ability to retrieve earlier versions of the same Contact but more than that, I’m confused by Outlook’s failure to update the “real” Contact in my Contacts folder as well as WDS’s reporting the location of these earlier (and later) Contacts as the “Inbox” instead of the Contacts folder (I have actually noticed, on occasion, a “Contact” icon in my Inbox, seemingly related to an ongoing Edit of a Contact, but again, it doesn’t happen all the time).
- Yesterday, I had a 0xD1 STOP Error (“DRIVER_IRQL_NOT_LESS_OR_
- I’m running Windows XP Pro (SP2) on a 2.8 GHz dual core machine with 512 MB RAM (new as of 3 months ago). I keep current on all Windows/Office updates, antivirus (AVG Free Edition – Updates and runs a Complete Test nightly), Windows Defender (runs nightly, too). I ran MS Office Diagnostics (fka “Detect and Repair”) a couple of weeks ago and it came up clean (I also just tried to run it again while composing this EE question and the entire system crashed, no warning, no STOP errors, no nothing. After re-booting the system, I ran it again and it still shows no problems. I ran an AdAware scan a few days ago – no issues. I’ve also run a couple of Registry cleaners (Registry Mechanic v. 6 is a little old at this point, though; and EasyCleaner), and ran through System Internals autoruns program, trying to clean up and look for anything suspicious.
- I have an extra hard drive that I use for the bulk of my Virtual Memory PageFile.sys as well as back up of critical files from my C: drive. For some reason, this drive is not visible in Windows Explorer unless I do a cold boot – if the system is just restarted, it does not see this drive (and my PageFile is not properly set up either – when the system automatically restarted after the last crash described above, I got this error shortly thereafter:
Application popup: procexp.exe - Application Error : The instruction at "0x00401b62" referenced memory at "0x000002f4". The memory could not be "written".
… possible this error was due to the drive not being seen by Windows and not fully implementing my Virtual Memory (?) as I did get a Virtual Memory warning shortly before this. Disk Management reports that this drive is “Healthy” as does other disk utilities.
- BTW, I meant to go to the Event Viewer right after the last crash happened to see what might be there, but with all of these other issues ongoing as well trying to re-create this EE question and dealing with a really flaky Wireless Network connection mucking up the works, I don’t think I got there right away so now I’m not sure if I’ve got the right one. Anyway, FWIW, this is the System Error I think was generated then: “Error code 10000050, parameter1 e57a7000, parameter2 00000000, parameter3 80539313, parameter4 00000001.”
- I usually use FireFox (v. 1.50.11) as my browser and will experience fairly frequent system "sluggishness", with inordinate delays in displaying any given URL – closing and re-opening FF and/or a re-boot will fix things for a while.
- I often have problems with FireFox being visible on the Task Bar but not in the Task Manager listing (and vice versa). This sometimes happens with other applications, too, including a given Outlook email or what have you.
I realize that all of the above is a veritable “kitchen sink” of issues that may not have anything to do with one another or my initial issue of Outlook closing unexpectedly but am just passing it on because a) they might be related and b) maybe someone can suggest solutions in these areas, too.
Thanks for any insights into this mess.
Jeff
Event Type: Error
Event Source: Microsoft Office 12
Event Category: None
Event ID: 1000
Date: 3/22/2007
Time: 8:51:33 AM
User: N/A
Computer: JSMITH
Description:
Faulting application outlook.exe, version 12.0.4518.1014, stamp 4542840f, faulting module ntdll.dll, version 5.1.2600.2180, stamp 411096b4, debug? 0, fault address 0x00011e58.
...
And this more frequently ...
Event Type: Error
Event Source: Microsoft Office 12
Event Category: None
Event ID: 5000
Date: 3/27/2007
Time: 3:57:21 PM
User: N/A
Computer: JSMITH
Description:
EventType office12asserttimer, P1 p1ml, P2 12.0.4518.0, P3 5, P4 515, P5 NIL, P6 NIL, P7 NIL, P8 NIL, P9 NIL, P10 NIL.
...
Unless I find a solution sooner, I'll try to pay more attention in the future to which Events are the most current at the time of Outlook closing and provide that info here, but I've also got other issues going on, too - not sure if they are related so I'll just mention some in passing in case they might be:
- Oftentimes (but not always), when I press Send on an email, I’ll notice the Outlook Status bar says “Sending 1 of 4 emails” when there should only be one being sent (I am familiar with Outlook sometimes queuing unsent emails in the Outbox if something interrupts their transmission but I don’t think is happening here; further, when I check the Sent folder after this happens, only the email I just sent is present within the recent time frame [again, I know that “Sent” emails can end up in other folders, too, but don’t believe this is the case here). Further, this anomaly always says “Sending 1 of 4 emails” (not some other number of “phantom” emails…).
- Just recently, I had the experience of looking for some information I was sure I had updated in one of my Outlook Contacts but it wasn’t there so I a did a Windows Desktop Search for the data and WDS found the information, in an Outlook Contact of the SAME name, but whose location was reported as “Personal Folders/Inbox” (there is only ONE such named Contact in my Contacts folder and it did NOT reflect the updated information, although this one found by WDS DID). Clarifying further, WDS found 3 versions of the Contact: a) one WITH the updated information and a location of “Personal Folders/Inbox”; b) another withOUT the updated information and a location of “Personal Folders/Contacts”; and c) another (earlier version) of the Contact with the same name and a location of “personal folders/inbox” (lower case this time). I guess I’m surprised as to WDS’s ability to retrieve earlier versions of the same Contact but more than that, I’m confused by Outlook’s failure to update the “real” Contact in my Contacts folder as well as WDS’s reporting the location of these earlier (and later) Contacts as the “Inbox” instead of the Contacts folder (I have actually noticed, on occasion, a “Contact” icon in my Inbox, seemingly related to an ongoing Edit of a Contact, but again, it doesn’t happen all the time).
- Yesterday, I had a 0xD1 STOP Error (“DRIVER_IRQL_NOT_LESS_OR_
- I’m running Windows XP Pro (SP2) on a 2.8 GHz dual core machine with 512 MB RAM (new as of 3 months ago). I keep current on all Windows/Office updates, antivirus (AVG Free Edition – Updates and runs a Complete Test nightly), Windows Defender (runs nightly, too). I ran MS Office Diagnostics (fka “Detect and Repair”) a couple of weeks ago and it came up clean (I also just tried to run it again while composing this EE question and the entire system crashed, no warning, no STOP errors, no nothing. After re-booting the system, I ran it again and it still shows no problems. I ran an AdAware scan a few days ago – no issues. I’ve also run a couple of Registry cleaners (Registry Mechanic v. 6 is a little old at this point, though; and EasyCleaner), and ran through System Internals autoruns program, trying to clean up and look for anything suspicious.
- I have an extra hard drive that I use for the bulk of my Virtual Memory PageFile.sys as well as back up of critical files from my C: drive. For some reason, this drive is not visible in Windows Explorer unless I do a cold boot – if the system is just restarted, it does not see this drive (and my PageFile is not properly set up either – when the system automatically restarted after the last crash described above, I got this error shortly thereafter:
Application popup: procexp.exe - Application Error : The instruction at "0x00401b62" referenced memory at "0x000002f4". The memory could not be "written".
… possible this error was due to the drive not being seen by Windows and not fully implementing my Virtual Memory (?) as I did get a Virtual Memory warning shortly before this. Disk Management reports that this drive is “Healthy” as does other disk utilities.
- BTW, I meant to go to the Event Viewer right after the last crash happened to see what might be there, but with all of these other issues ongoing as well trying to re-create this EE question and dealing with a really flaky Wireless Network connection mucking up the works, I don’t think I got there right away so now I’m not sure if I’ve got the right one. Anyway, FWIW, this is the System Error I think was generated then: “Error code 10000050, parameter1 e57a7000, parameter2 00000000, parameter3 80539313, parameter4 00000001.”
- I usually use FireFox (v. 1.50.11) as my browser and will experience fairly frequent system "sluggishness", with inordinate delays in displaying any given URL – closing and re-opening FF and/or a re-boot will fix things for a while.
- I often have problems with FireFox being visible on the Task Bar but not in the Task Manager listing (and vice versa). This sometimes happens with other applications, too, including a given Outlook email or what have you.
I realize that all of the above is a veritable “kitchen sink” of issues that may not have anything to do with one another or my initial issue of Outlook closing unexpectedly but am just passing it on because a) they might be related and b) maybe someone can suggest solutions in these areas, too.
Thanks for any insights into this mess.
Jeff
You don't mention how much physical memory you have or the rest of your system.
Do you have enough? Firefox has been known on occasion to run up the memory usage, so a hang is not unheard of. http://kb.mozillazine.org/Reducing_memory_usage_-_Firefox
Outlook event id 1000
http://support.microsoft.com/kb/841273/en-us
But with the plethora of issues you describe, I would suggest, a full backup of any important data, reformat and fresh install. The above issues smell of virus/malware (especially osaio.sys) so that is going to be my recommendation. If you would like some troubleshooting before you go to that extreme, you could Download and run Hijack This http://www.tomcoyote.org/hjt/
Post the log to this site as well as here, http://www.hijackthis.de/ hit Analyze, Save the analysis link and post the link's address here at EE.
Do you have enough? Firefox has been known on occasion to run up the memory usage, so a hang is not unheard of. http://kb.mozillazine.org/Reducing_memory_usage_-_Firefox
Outlook event id 1000
http://support.microsoft.com/kb/841273/en-us
But with the plethora of issues you describe, I would suggest, a full backup of any important data, reformat and fresh install. The above issues smell of virus/malware (especially osaio.sys) so that is going to be my recommendation. If you would like some troubleshooting before you go to that extreme, you could Download and run Hijack This http://www.tomcoyote.org/hjt/
Post the log to this site as well as here, http://www.hijackthis.de/ hit Analyze, Save the analysis link and post the link's address here at EE.
ASKER
Hi Frankco & mtz1of4 - Thanks for logging in on this.
Frankco:
> First, make sure IE is your default browser
Can you help me understand why this is related to my Outlook issue? I've been using FF for quite some time and prefer it due to it's feature set. I had also been using FF & Outlook 2007 together for a couple of months without this problem of OL closing unexepectedly ...
> Second, and the most common cause of OL 2007 crashing is old addins.
Well, since the PC is less than 3 months old, I don't think any of the Add-Ins are "old". I didn't knowingly install any OL Add-ins but when I checked the list, I found: a) one which had been added by the PC OEM relating to "eDataSecurity", an encryption tool (which I made Inactive as this was throwing an error whenever I tried to run it anyway, saying it wasn't installed properly); and b) these (which were all from Microsoft): "Microsoft Exchange Unified Messaging"; "Microsoft Office SharePoint Server Colleague Import Add-In"; "Microsoft Outlook Mobile Service"; and "Windows Search Email Indexer". Also on the "Inactive Application Add-ins" list is "Microsoft Access Outlook Add-in for Data Collection and Publishing" and "Microsoft VBA for Outlook Addin". Further, there is an item listed under "Disabled Application Add-ins" named "MSN Toolbar". These were all COM Add-ins. Given the source of these add-ins, are you still suggesting I disable all of these and test them individually? It may take quite some time to do this as the system may run for a day or two without OL closing ...
mtz1of4:
> You don't mention how much physical memory you have or the rest of your system.
Actually, I did mention this in my rather lenghty original post "I’m running Windows XP Pro (SP2) on a 2.8 GHz dual core machine with 512 MB RAM (new as of 3 months ago)". There are further details following that for my update and defensive software status. I had already had occasion to visit the FireFox link (thanks), and had made most of the changes recommended there. I've also recently reconfigured my Virtual Memory across both of my hard drives and set it up as a fixed size = 3X my RAM (total of 1536 MB).
> Outlook event id 1000
> http://support.microsoft.com/kb/841273/en-us
I didn't read the whole kb article, but this seems to be dealing with Offline Address Books in a MS Exchange-based Client/Server environment ... is this what you meant to refer me to? If so, I am missing the connection ...
I'll take a stab at Hijack This but it will be tomorrow at the earliest before I'll be able to do that. I'll report back with findings.
Jeff
Frankco:
> First, make sure IE is your default browser
Can you help me understand why this is related to my Outlook issue? I've been using FF for quite some time and prefer it due to it's feature set. I had also been using FF & Outlook 2007 together for a couple of months without this problem of OL closing unexepectedly ...
> Second, and the most common cause of OL 2007 crashing is old addins.
Well, since the PC is less than 3 months old, I don't think any of the Add-Ins are "old". I didn't knowingly install any OL Add-ins but when I checked the list, I found: a) one which had been added by the PC OEM relating to "eDataSecurity", an encryption tool (which I made Inactive as this was throwing an error whenever I tried to run it anyway, saying it wasn't installed properly); and b) these (which were all from Microsoft): "Microsoft Exchange Unified Messaging"; "Microsoft Office SharePoint Server Colleague Import Add-In"; "Microsoft Outlook Mobile Service"; and "Windows Search Email Indexer". Also on the "Inactive Application Add-ins" list is "Microsoft Access Outlook Add-in for Data Collection and Publishing" and "Microsoft VBA for Outlook Addin". Further, there is an item listed under "Disabled Application Add-ins" named "MSN Toolbar". These were all COM Add-ins. Given the source of these add-ins, are you still suggesting I disable all of these and test them individually? It may take quite some time to do this as the system may run for a day or two without OL closing ...
mtz1of4:
> You don't mention how much physical memory you have or the rest of your system.
Actually, I did mention this in my rather lenghty original post "I’m running Windows XP Pro (SP2) on a 2.8 GHz dual core machine with 512 MB RAM (new as of 3 months ago)". There are further details following that for my update and defensive software status. I had already had occasion to visit the FireFox link (thanks), and had made most of the changes recommended there. I've also recently reconfigured my Virtual Memory across both of my hard drives and set it up as a fixed size = 3X my RAM (total of 1536 MB).
> Outlook event id 1000
> http://support.microsoft.com/kb/841273/en-us
I didn't read the whole kb article, but this seems to be dealing with Offline Address Books in a MS Exchange-based Client/Server environment ... is this what you meant to refer me to? If so, I am missing the connection ...
I'll take a stab at Hijack This but it will be tomorrow at the earliest before I'll be able to do that. I'll report back with findings.
Jeff
ASKER
Ok - Downloaded HJT v1.99. The analysis is posted at:
http://www.hijackthis.de/logfiles/9ce8f58f69f56790360d11aba3475584.html
Here is the log for that:
Logfile of HijackThis v1.99.1
Scan saved at 10:28:17 PM, on 4/2/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)
Running processes:
C:\WINDOWS\System32\smss.e
C:\WINDOWS\system32\winlog
C:\WINDOWS\system32\servic
C:\WINDOWS\system32\lsass.
C:\WINDOWS\system32\svchos
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchos
C:\WINDOWS\system32\spools
C:\Acer\Empowering Technology\ePerformance\Me
C:\PROGRA~1\Grisoft\AVGFRE
C:\PROGRA~1\Grisoft\AVGFRE
C:\PROGRA~1\Grisoft\AVGFRE
C:\Acer\LANScope Agent\awServ.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.e
C:\Acer\Empowering Technology\eLock\LockServ.
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\Search
C:\WINDOWS\Explorer.EXE
F:\F_\Archived\Installed\S
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\PROGRA~1\Grisoft\AVGFRE
C:\WINDOWS\system32\tasksw
C:\Program Files\Google\GoogleToolbar
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.e
C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
C:\Program Files\HyperSnap-DX 5\HprSnap5.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\FreeWheel\FreeWheel.
C:\WINDOWS\System32\svchos
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EX
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\JGsoft\EditPadLite\E
C:\Archived\HiJackThis\Hij
R1 - HKCU\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
R0 - HKCU\Software\Microsoft\In
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-2
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-0
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-B
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-C
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-6
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-0
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-0
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-6
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\tasksw
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbar
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.e
O4 - Startup: FreeWheel.lnk = C:\Program Files\FreeWheel\FreeWheel.
O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync
O4 - Global Startup: HyperSnap-DX 5.lnk = C:\Program Files\HyperSnap-DX 5\HprSnap5.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.h
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustom
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillFo
O8 - Extra context menu item: RoboForm Options - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComOption
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePa
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-0
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-0
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-0
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-0
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-0
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-0
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: http://download.windowsupdate.com
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-8
O16 - DPF: {17492023-C23A-453E-A040-C
O16 - DPF: {5ED80217-570B-4DA9-BF44-B
O16 - DPF: {6B75345B-AA36-438A-BBE6-4
O16 - DPF: {6E32070A-766D-4EE6-879C-D
O16 - DPF: {E8F628B5-259A-4734-97EE-B
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-0
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-0
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxde
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLog
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-9
O23 - Service: Memory Check Service (AcerMemUsageCheckService)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE
O23 - Service: AdminWorks Agent X6 (AWService) - OSA Technologies Inc., An Avocent Company - C:\Acer\LANScope Agent\awServ.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.e
O23 - Service: LockServ - Unknown owner - C:\Acer\Empowering Technology\eLock\LockServ.
O23 - Service: ProgramCheckerPro (sassvc) - Unknown owner - C:\Program Files\ProgramChecker\sassv
O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Program Files\RealVNC\VNC4\WinVNC4
**************************
I also downloaded HJT v2.0 Beta - here is that log:
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 10:14:20 PM, on 4/2/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.e
C:\WINDOWS\system32\winlog
C:\WINDOWS\system32\servic
C:\WINDOWS\system32\lsass.
C:\WINDOWS\system32\svchos
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchos
C:\WINDOWS\system32\spools
C:\Acer\Empowering Technology\ePerformance\Me
C:\PROGRA~1\Grisoft\AVGFRE
C:\PROGRA~1\Grisoft\AVGFRE
C:\PROGRA~1\Grisoft\AVGFRE
C:\Acer\LANScope Agent\awServ.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.e
C:\Acer\Empowering Technology\eLock\LockServ.
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\Search
C:\WINDOWS\Explorer.EXE
F:\F_\Archived\Installed\S
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\PROGRA~1\Grisoft\AVGFRE
C:\WINDOWS\system32\tasksw
C:\Program Files\Google\GoogleToolbar
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.e
C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
C:\Program Files\HyperSnap-DX 5\HprSnap5.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\FreeWheel\FreeWheel.
C:\WINDOWS\System32\svchos
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EX
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\Search
C:\Archived\HiJackThis\HiJ
R1 - HKCU\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
R0 - HKCU\Software\Microsoft\In
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-2
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-0
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-B
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-C
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-6
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-0
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-0
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-6
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\tasksw
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbar
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.e
O4 - HKLM\..\Policies\Explorer\
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE
O4 - Startup: FreeWheel.lnk = C:\Program Files\FreeWheel\FreeWheel.
O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync
O4 - Global Startup: HyperSnap-DX 5.lnk = C:\Program Files\HyperSnap-DX 5\HprSnap5.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.h
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustom
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillFo
O8 - Extra context menu item: RoboForm Options - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComOption
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePa
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-0
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-0
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-0
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-0
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-0
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-0
O15 - Trusted Zone: http://download.windowsupdate.com
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-8
O16 - DPF: {17492023-C23A-453E-A040-C
O16 - DPF: {5ED80217-570B-4DA9-BF44-B
O16 - DPF: {6B75345B-AA36-438A-BBE6-4
O16 - DPF: {6E32070A-766D-4EE6-879C-D
O16 - DPF: {E8F628B5-259A-4734-97EE-B
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-0
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3
O23 - Service: Memory Check Service (AcerMemUsageCheckService)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE
O23 - Service: AdminWorks Agent X6 (AWService) - OSA Technologies Inc., An Avocent Company - C:\Acer\LANScope Agent\awServ.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.e
O23 - Service: LockServ - Unknown owner - C:\Acer\Empowering Technology\eLock\LockServ.
O23 - Service: ProgramCheckerPro (sassvc) - Unknown owner - C:\Program Files\ProgramChecker\sassv
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4
--
End of file - 11048 bytes
**************************
The "Analysis" button in v2.0 Beta took me to a page on the TrendMicro site where this info was provided (doesn't quite line up here but I think it's still legible):
Comparison of your HijackThis log file items to others
The table below compares the items HijackThis found on your computer with those on other people's computers. The column "% of PCs with item" indicates what percent of other people's HijackThis log files contain the item in that row of the table. Additional information will be provided as more HijackThis log files are added to the AnalyzeThis database.
Each entry is coded to indicate the type of item it is on your computer. An explanation of these codes may be found at the bottom of this page.
Index % of PCs with item Code Data
1 0.3% O15 http://download.windowsupdate.com
2 16.3% O16 {17492023-C23A-453E-A040-C
3 2.2% O16 {5ED80217-570B-4DA9-BF44-B
4 0.9% O16 {E8F628B5-259A-4734-97EE-B
5 0.3% O16 {0742B9EF-8C83-41CA-BFBA-8
6 0.2% O16 {6B75345B-AA36-438A-BBE6-4
7 0.0% O16 {6E32070A-766D-4EE6-879C-D
8 17.3% O2 (no name) - {7E853D72-626A-48EC-A868-B
9 14.4% O2 (no name) - {53707962-6F74-2D53-2644-2
10 7.7% O2 Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5
11 5.4% O2 Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-C
12 5.3% O2 Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7
13 3.7% O2 Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-6
14 2.9% O2 SSVHelper Class - {761497BB-D6F0-462C-B6EB-D
15 0.8% O2 (no name) - {724d43a9-0d85-11d4-9908-0
16 48.0% O22 Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3
17 46.4% O22 Browseui preloader - {438755C2-A8BA-11D1-B96B-0
18 17.6% O23 Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google
19 5.2% O23 AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE
20 5.1% O23 AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE
21 4.6% O23 InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver
22 3.9% O23 AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE
23 3.8% O23 LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.e
24 1.2% O23 VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4
25 0.4% O23 Memory Check Service (AcerMemUsageCheckService)
26 0.0% O23 LockServ - Unknown owner - C:\Acer\Empowering Technology\eLock\LockServ.
27 0.0% O23 AdminWorks Agent X6 (AWService) - OSA Technologies Inc., An Avocent Company - C:\Acer\LANScope Agent\awServ.exe
28 0.0% O23 ProgramCheckerPro (sassvc) - Unknown owner - C:\Program Files\ProgramChecker\sassv
29 5.9% O3 Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0
30 5.4% O3 &Google - {2318C2B1-4965-11d4-9B18-0
31 3.8% O3 Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-6
32 0.9% O3 &RoboForm - {724d43a0-0d85-11d4-9908-0
33 13.7% O4 [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
34 10.5% O4 [swg] C:\Program Files\Google\GoogleToolbar
35 6.8% O4 [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
36 6.2% O4 Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync
37 5.3% O4 [RTHDCPL] RTHDCPL.EXE
38 4.9% O4 Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
39 4.6% O4 [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE
40 3.4% O4 [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE
41 2.6% O4 [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE
42 1.7% O4 [SkyTel] SkyTel.EXE
43 1.2% O4 [CoolSwitch] C:\WINDOWS\system32\tasksw
44 0.8% O4 Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
45 0.5% O4 [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.e
46 0.4% O4 [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
47 0.1% O4 Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
48 0.0% O4 FreeWheel.lnk = C:\Program Files\FreeWheel\FreeWheel.
49 0.0% O4 [1] F:\F_\Archived\Installed\S
50 0.0% O4 HyperSnap-DX 5.lnk = C:\Program Files\HyperSnap-DX 5\HprSnap5.exe
51 3.6% O8 &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.h
52 3.3% O8 Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
53 2.3% O8 E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2
54 0.6% O8 Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillFo
55 0.6% O8 Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePa
56 0.6% O8 Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustom
57 0.0% O8 RoboForm Options - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComOption
58 40.9% O9 Messenger - {FB5F1910-F110-11d2-BB9E-0
59 40.2% O9 Windows Messenger - {FB5F1910-F110-11d2-BB9E-0
60 29.8% O9 @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f
61 29.8% O9 (no name) - {e2e2dd38-d088-4134-82b7-f
62 3.5% O9 Research - {92780B25-18CC-41C8-B9BE-3
63 2.4% O9 (no name) - {08B0E5C0-4FCB-11CF-AAA5-0
64 2.1% O9 Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-0
65 0.7% O9 RoboForm - {724d43aa-0d85-11d4-9908-0
66 0.6% O9 Fill Forms - {320AF880-6646-11D3-ABEE-C
67 0.6% O9 Save - {320AF880-6646-11D3-ABEE-C
68 0.6% O9 RoboForm Toolbar - {724d43aa-0d85-11d4-9908-0
69 0.6% O9 Save Forms - {320AF880-6646-11D3-ABEE-C
70 84.6% P01 C:\WINDOWS\Explorer.EXE
71 82.6% P01 C:\WINDOWS\system32\svchos
72 82.5% P01 C:\WINDOWS\system32\lsass.
73 82.5% P01 C:\WINDOWS\system32\winlog
74 82.5% P01 C:\WINDOWS\system32\servic
75 82.4% P01 C:\WINDOWS\System32\smss.e
76 79.2% P01 C:\WINDOWS\system32\spools
77 16.8% P01 C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
78 14.5% P01 C:\Program Files\MSN Messenger\MsnMsgr.Exe
79 12.3% P01 C:\Program Files\Mozilla Firefox\firefox.exe
80 10.1% P01 C:\Program Files\Google\GoogleToolbar
81 7.8% P01 C:\Program Files\Windows Defender\MSASCui.exe
82 7.7% P01 C:\Program Files\Windows Defender\MsMpEng.exe
83 5.3% P01 C:\PROGRA~1\Grisoft\AVGFRE
84 5.3% P01 C:\PROGRA~1\Grisoft\AVGFRE
85 5.2% P01 C:\WINDOWS\RTHDCPL.EXE
86 4.6% P01 C:\PROGRA~1\Grisoft\AVGFRE
87 4.0% P01 C:\PROGRA~1\Grisoft\AVGFRE
88 4.0% P01 C:\Program Files\Common Files\LightScribe\LSSrvc.e
89 1.2% P01 C:\WINDOWS\system32\tasksw
90 1.1% P01 C:\WINDOWS\system32\Search
91 0.7% P01 C:\Program Files\Windows Desktop Search\WindowsSearch.exe
92 0.5% P01 C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.e
93 0.5% P01 C:\Program Files\Microsoft Office\Office12\OUTLOOK.EX
94 0.4% P01 C:\Acer\Empowering Technology\ePerformance\Me
95 0.1% P01 C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
96 0.0% P01 C:\Acer\Empowering Technology\eLock\LockServ.
97 0.0% P01 C:\Program Files\JGsoft\EditPadLite\E
98 0.0% P01 C:\Acer\LANScope Agent\awServ.exe
99 0.0% P01 C:\Program Files\FreeWheel\FreeWheel.
100 0.0% P01 F:\F_\Archived\Installed\S
101 0.0% P01 C:\Program Files\HyperSnap-DX 5\HprSnap5.exe
102 0.0% P01 C:\Archived\HiJackThis\HiJ
103 28.4% R0 HKLM\Software\Microsoft\In
104 10.3% R0 HKCU\Software\Microsoft\In
105 32.8% R1 HKLM\Software\Microsoft\In
106 31.6% R1 HKLM\Software\Microsoft\In
107 30.8% R1 HKLM\Software\Microsoft\In
108 0.8% R1 HKCU\Software\Microsoft\In
109 0.6% R1 HKCU\Software\Microsoft\In
110 0.6% R1 HKCU\Software\Microsoft\In
111 3.4% R3 Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0
Explanation of the codes
R - Registry, StartPage/SearchPage changes
* R0 - Changed registry value
* R1 - Created registry value
* R2 - Created registry key
* R3 - Created extra registry value where only one should be
F - IniFiles, autoloading entries
* F0 - Changed inifile value
* F1 - Created inifile value
* F2 - Changed inifile value, mapped to Registry
* F3 - Created inifile value, mapped to Registry
N - Netscape/Mozilla StartPage/SearchPage changes
* N1 - Change in prefs.js of Netscape 4.x
* N2 - Change in prefs.js of Netscape 6
* N3 - Change in prefs.js of Netscape 7
* N4 - Change in prefs.js of Mozilla
O - Other, several sections which represent:
* O1 - Hijack of auto.search.msn.com with Hosts file
* O2 - Enumeration of existing MSIE BHO's
* O3 - Enumeration of existing MSIE toolbars
* O4 - Enumeration of suspicious autoloading Registry entries
* O5 - Blocking of loading Internet Options in Control Panel
* O6 - Disabling of 'Internet Options' Main tab with Policies
* O7 - Disabling of Regedit with Policies
* O8 - Extra MSIE context menu items
* O9 - Extra 'Tools' menuitems and buttons
* O10 - Breaking of Internet access by New.Net or WebHancer
* O11 - Extra options in MSIE 'Advanced' settings tab
* O12 - MSIE plugins for file extensions or MIME types
* O13 - Hijack of default URL prefixes
* O14 - Changing of IERESET.INF
* O15 - Trusted Zone Autoadd
* O16 - Download Program Files item
* O17 - Domain hijack
* O18 - Enumeration of existing protocols and filters
* O19 - User stylesheet hijack
* O20 - AppInit_DLLs autorun Registry value, Winlogon Notify Registry keys
* O21 - ShellServiceObjectDelayLoa
* O22 - SharedTaskScheduler autorun Registry key
* O23 - Enumeration of NT Services
* O24 - Enumeration of ActiveX Desktop Components
Jeff
http://www.hijackthis.de/logfiles/9ce8f58f69f56790360d11aba3475584.html
Here is the log for that:
Logfile of HijackThis v1.99.1
Scan saved at 10:28:17 PM, on 4/2/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)
Running processes:
C:\WINDOWS\System32\smss.e
C:\WINDOWS\system32\winlog
C:\WINDOWS\system32\servic
C:\WINDOWS\system32\lsass.
C:\WINDOWS\system32\svchos
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchos
C:\WINDOWS\system32\spools
C:\Acer\Empowering Technology\ePerformance\Me
C:\PROGRA~1\Grisoft\AVGFRE
C:\PROGRA~1\Grisoft\AVGFRE
C:\PROGRA~1\Grisoft\AVGFRE
C:\Acer\LANScope Agent\awServ.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.e
C:\Acer\Empowering Technology\eLock\LockServ.
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\Search
C:\WINDOWS\Explorer.EXE
F:\F_\Archived\Installed\S
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\PROGRA~1\Grisoft\AVGFRE
C:\WINDOWS\system32\tasksw
C:\Program Files\Google\GoogleToolbar
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.e
C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
C:\Program Files\HyperSnap-DX 5\HprSnap5.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\FreeWheel\FreeWheel.
C:\WINDOWS\System32\svchos
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EX
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\JGsoft\EditPadLite\E
C:\Archived\HiJackThis\Hij
R1 - HKCU\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
R0 - HKCU\Software\Microsoft\In
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-2
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-0
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-B
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-C
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-6
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-0
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-0
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-6
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\tasksw
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbar
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.e
O4 - Startup: FreeWheel.lnk = C:\Program Files\FreeWheel\FreeWheel.
O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync
O4 - Global Startup: HyperSnap-DX 5.lnk = C:\Program Files\HyperSnap-DX 5\HprSnap5.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.h
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustom
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillFo
O8 - Extra context menu item: RoboForm Options - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComOption
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePa
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-0
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-0
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-0
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-0
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-0
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-0
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: http://download.windowsupdate.com
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-8
O16 - DPF: {17492023-C23A-453E-A040-C
O16 - DPF: {5ED80217-570B-4DA9-BF44-B
O16 - DPF: {6B75345B-AA36-438A-BBE6-4
O16 - DPF: {6E32070A-766D-4EE6-879C-D
O16 - DPF: {E8F628B5-259A-4734-97EE-B
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-0
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-0
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxde
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLog
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-9
O23 - Service: Memory Check Service (AcerMemUsageCheckService)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE
O23 - Service: AdminWorks Agent X6 (AWService) - OSA Technologies Inc., An Avocent Company - C:\Acer\LANScope Agent\awServ.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.e
O23 - Service: LockServ - Unknown owner - C:\Acer\Empowering Technology\eLock\LockServ.
O23 - Service: ProgramCheckerPro (sassvc) - Unknown owner - C:\Program Files\ProgramChecker\sassv
O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Program Files\RealVNC\VNC4\WinVNC4
**************************
I also downloaded HJT v2.0 Beta - here is that log:
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 10:14:20 PM, on 4/2/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.e
C:\WINDOWS\system32\winlog
C:\WINDOWS\system32\servic
C:\WINDOWS\system32\lsass.
C:\WINDOWS\system32\svchos
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchos
C:\WINDOWS\system32\spools
C:\Acer\Empowering Technology\ePerformance\Me
C:\PROGRA~1\Grisoft\AVGFRE
C:\PROGRA~1\Grisoft\AVGFRE
C:\PROGRA~1\Grisoft\AVGFRE
C:\Acer\LANScope Agent\awServ.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.e
C:\Acer\Empowering Technology\eLock\LockServ.
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\Search
C:\WINDOWS\Explorer.EXE
F:\F_\Archived\Installed\S
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\PROGRA~1\Grisoft\AVGFRE
C:\WINDOWS\system32\tasksw
C:\Program Files\Google\GoogleToolbar
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.e
C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
C:\Program Files\HyperSnap-DX 5\HprSnap5.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\FreeWheel\FreeWheel.
C:\WINDOWS\System32\svchos
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EX
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\Search
C:\Archived\HiJackThis\HiJ
R1 - HKCU\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
R0 - HKCU\Software\Microsoft\In
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-2
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-0
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-B
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-C
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-6
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-0
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-0
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-6
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\tasksw
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbar
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.e
O4 - HKLM\..\Policies\Explorer\
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE
O4 - Startup: FreeWheel.lnk = C:\Program Files\FreeWheel\FreeWheel.
O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync
O4 - Global Startup: HyperSnap-DX 5.lnk = C:\Program Files\HyperSnap-DX 5\HprSnap5.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.h
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustom
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillFo
O8 - Extra context menu item: RoboForm Options - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComOption
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePa
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-0
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-0
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-0
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-0
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-0
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-0
O15 - Trusted Zone: http://download.windowsupdate.com
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-8
O16 - DPF: {17492023-C23A-453E-A040-C
O16 - DPF: {5ED80217-570B-4DA9-BF44-B
O16 - DPF: {6B75345B-AA36-438A-BBE6-4
O16 - DPF: {6E32070A-766D-4EE6-879C-D
O16 - DPF: {E8F628B5-259A-4734-97EE-B
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-0
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3
O23 - Service: Memory Check Service (AcerMemUsageCheckService)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE
O23 - Service: AdminWorks Agent X6 (AWService) - OSA Technologies Inc., An Avocent Company - C:\Acer\LANScope Agent\awServ.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.e
O23 - Service: LockServ - Unknown owner - C:\Acer\Empowering Technology\eLock\LockServ.
O23 - Service: ProgramCheckerPro (sassvc) - Unknown owner - C:\Program Files\ProgramChecker\sassv
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4
--
End of file - 11048 bytes
**************************
The "Analysis" button in v2.0 Beta took me to a page on the TrendMicro site where this info was provided (doesn't quite line up here but I think it's still legible):
Comparison of your HijackThis log file items to others
The table below compares the items HijackThis found on your computer with those on other people's computers. The column "% of PCs with item" indicates what percent of other people's HijackThis log files contain the item in that row of the table. Additional information will be provided as more HijackThis log files are added to the AnalyzeThis database.
Each entry is coded to indicate the type of item it is on your computer. An explanation of these codes may be found at the bottom of this page.
Index % of PCs with item Code Data
1 0.3% O15 http://download.windowsupdate.com
2 16.3% O16 {17492023-C23A-453E-A040-C
3 2.2% O16 {5ED80217-570B-4DA9-BF44-B
4 0.9% O16 {E8F628B5-259A-4734-97EE-B
5 0.3% O16 {0742B9EF-8C83-41CA-BFBA-8
6 0.2% O16 {6B75345B-AA36-438A-BBE6-4
7 0.0% O16 {6E32070A-766D-4EE6-879C-D
8 17.3% O2 (no name) - {7E853D72-626A-48EC-A868-B
9 14.4% O2 (no name) - {53707962-6F74-2D53-2644-2
10 7.7% O2 Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5
11 5.4% O2 Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-C
12 5.3% O2 Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7
13 3.7% O2 Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-6
14 2.9% O2 SSVHelper Class - {761497BB-D6F0-462C-B6EB-D
15 0.8% O2 (no name) - {724d43a9-0d85-11d4-9908-0
16 48.0% O22 Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3
17 46.4% O22 Browseui preloader - {438755C2-A8BA-11D1-B96B-0
18 17.6% O23 Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google
19 5.2% O23 AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE
20 5.1% O23 AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE
21 4.6% O23 InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver
22 3.9% O23 AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE
23 3.8% O23 LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.e
24 1.2% O23 VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4
25 0.4% O23 Memory Check Service (AcerMemUsageCheckService)
26 0.0% O23 LockServ - Unknown owner - C:\Acer\Empowering Technology\eLock\LockServ.
27 0.0% O23 AdminWorks Agent X6 (AWService) - OSA Technologies Inc., An Avocent Company - C:\Acer\LANScope Agent\awServ.exe
28 0.0% O23 ProgramCheckerPro (sassvc) - Unknown owner - C:\Program Files\ProgramChecker\sassv
29 5.9% O3 Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0
30 5.4% O3 &Google - {2318C2B1-4965-11d4-9B18-0
31 3.8% O3 Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-6
32 0.9% O3 &RoboForm - {724d43a0-0d85-11d4-9908-0
33 13.7% O4 [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
34 10.5% O4 [swg] C:\Program Files\Google\GoogleToolbar
35 6.8% O4 [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
36 6.2% O4 Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync
37 5.3% O4 [RTHDCPL] RTHDCPL.EXE
38 4.9% O4 Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
39 4.6% O4 [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE
40 3.4% O4 [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE
41 2.6% O4 [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE
42 1.7% O4 [SkyTel] SkyTel.EXE
43 1.2% O4 [CoolSwitch] C:\WINDOWS\system32\tasksw
44 0.8% O4 Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
45 0.5% O4 [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.e
46 0.4% O4 [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
47 0.1% O4 Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
48 0.0% O4 FreeWheel.lnk = C:\Program Files\FreeWheel\FreeWheel.
49 0.0% O4 [1] F:\F_\Archived\Installed\S
50 0.0% O4 HyperSnap-DX 5.lnk = C:\Program Files\HyperSnap-DX 5\HprSnap5.exe
51 3.6% O8 &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.h
52 3.3% O8 Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
53 2.3% O8 E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2
54 0.6% O8 Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillFo
55 0.6% O8 Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePa
56 0.6% O8 Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustom
57 0.0% O8 RoboForm Options - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComOption
58 40.9% O9 Messenger - {FB5F1910-F110-11d2-BB9E-0
59 40.2% O9 Windows Messenger - {FB5F1910-F110-11d2-BB9E-0
60 29.8% O9 @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f
61 29.8% O9 (no name) - {e2e2dd38-d088-4134-82b7-f
62 3.5% O9 Research - {92780B25-18CC-41C8-B9BE-3
63 2.4% O9 (no name) - {08B0E5C0-4FCB-11CF-AAA5-0
64 2.1% O9 Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-0
65 0.7% O9 RoboForm - {724d43aa-0d85-11d4-9908-0
66 0.6% O9 Fill Forms - {320AF880-6646-11D3-ABEE-C
67 0.6% O9 Save - {320AF880-6646-11D3-ABEE-C
68 0.6% O9 RoboForm Toolbar - {724d43aa-0d85-11d4-9908-0
69 0.6% O9 Save Forms - {320AF880-6646-11D3-ABEE-C
70 84.6% P01 C:\WINDOWS\Explorer.EXE
71 82.6% P01 C:\WINDOWS\system32\svchos
72 82.5% P01 C:\WINDOWS\system32\lsass.
73 82.5% P01 C:\WINDOWS\system32\winlog
74 82.5% P01 C:\WINDOWS\system32\servic
75 82.4% P01 C:\WINDOWS\System32\smss.e
76 79.2% P01 C:\WINDOWS\system32\spools
77 16.8% P01 C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
78 14.5% P01 C:\Program Files\MSN Messenger\MsnMsgr.Exe
79 12.3% P01 C:\Program Files\Mozilla Firefox\firefox.exe
80 10.1% P01 C:\Program Files\Google\GoogleToolbar
81 7.8% P01 C:\Program Files\Windows Defender\MSASCui.exe
82 7.7% P01 C:\Program Files\Windows Defender\MsMpEng.exe
83 5.3% P01 C:\PROGRA~1\Grisoft\AVGFRE
84 5.3% P01 C:\PROGRA~1\Grisoft\AVGFRE
85 5.2% P01 C:\WINDOWS\RTHDCPL.EXE
86 4.6% P01 C:\PROGRA~1\Grisoft\AVGFRE
87 4.0% P01 C:\PROGRA~1\Grisoft\AVGFRE
88 4.0% P01 C:\Program Files\Common Files\LightScribe\LSSrvc.e
89 1.2% P01 C:\WINDOWS\system32\tasksw
90 1.1% P01 C:\WINDOWS\system32\Search
91 0.7% P01 C:\Program Files\Windows Desktop Search\WindowsSearch.exe
92 0.5% P01 C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.e
93 0.5% P01 C:\Program Files\Microsoft Office\Office12\OUTLOOK.EX
94 0.4% P01 C:\Acer\Empowering Technology\ePerformance\Me
95 0.1% P01 C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
96 0.0% P01 C:\Acer\Empowering Technology\eLock\LockServ.
97 0.0% P01 C:\Program Files\JGsoft\EditPadLite\E
98 0.0% P01 C:\Acer\LANScope Agent\awServ.exe
99 0.0% P01 C:\Program Files\FreeWheel\FreeWheel.
100 0.0% P01 F:\F_\Archived\Installed\S
101 0.0% P01 C:\Program Files\HyperSnap-DX 5\HprSnap5.exe
102 0.0% P01 C:\Archived\HiJackThis\HiJ
103 28.4% R0 HKLM\Software\Microsoft\In
104 10.3% R0 HKCU\Software\Microsoft\In
105 32.8% R1 HKLM\Software\Microsoft\In
106 31.6% R1 HKLM\Software\Microsoft\In
107 30.8% R1 HKLM\Software\Microsoft\In
108 0.8% R1 HKCU\Software\Microsoft\In
109 0.6% R1 HKCU\Software\Microsoft\In
110 0.6% R1 HKCU\Software\Microsoft\In
111 3.4% R3 Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0
Explanation of the codes
R - Registry, StartPage/SearchPage changes
* R0 - Changed registry value
* R1 - Created registry value
* R2 - Created registry key
* R3 - Created extra registry value where only one should be
F - IniFiles, autoloading entries
* F0 - Changed inifile value
* F1 - Created inifile value
* F2 - Changed inifile value, mapped to Registry
* F3 - Created inifile value, mapped to Registry
N - Netscape/Mozilla StartPage/SearchPage changes
* N1 - Change in prefs.js of Netscape 4.x
* N2 - Change in prefs.js of Netscape 6
* N3 - Change in prefs.js of Netscape 7
* N4 - Change in prefs.js of Mozilla
O - Other, several sections which represent:
* O1 - Hijack of auto.search.msn.com with Hosts file
* O2 - Enumeration of existing MSIE BHO's
* O3 - Enumeration of existing MSIE toolbars
* O4 - Enumeration of suspicious autoloading Registry entries
* O5 - Blocking of loading Internet Options in Control Panel
* O6 - Disabling of 'Internet Options' Main tab with Policies
* O7 - Disabling of Regedit with Policies
* O8 - Extra MSIE context menu items
* O9 - Extra 'Tools' menuitems and buttons
* O10 - Breaking of Internet access by New.Net or WebHancer
* O11 - Extra options in MSIE 'Advanced' settings tab
* O12 - MSIE plugins for file extensions or MIME types
* O13 - Hijack of default URL prefixes
* O14 - Changing of IERESET.INF
* O15 - Trusted Zone Autoadd
* O16 - Download Program Files item
* O17 - Domain hijack
* O18 - Enumeration of existing protocols and filters
* O19 - User stylesheet hijack
* O20 - AppInit_DLLs autorun Registry value, Winlogon Notify Registry keys
* O21 - ShellServiceObjectDelayLoa
* O22 - SharedTaskScheduler autorun Registry key
* O23 - Enumeration of NT Services
* O24 - Enumeration of ActiveX Desktop Components
Jeff
Hi jeffreywsmith,
Internet Explorer is what Outlook uses to view your HTML emails. It is tied directly to Outlook.
You have a lot going on when your computer starts. I think this will be a process of elimination. Some applications may not work well with OL2007. For instance, Adobe PDF addin is not compatible with 2007. It doesn’t crash OL, it just doesn’t work. As far as the other programs you have running, you will have to remove them or disable them to check.
You should get rid of the toolbar helpers. Yahoo, Google.
I haven’t used GRISOFT anti virus software and don’t know how it plays with OL 2007. I would suggest that you run version 7.5 if you are not or disable it.
Do you need a password manager? If you can live without it, uninstall RoboForm.
Remove the Adobe Speed launcher from your startup folder. Right click it and delete the shortcut. this shouldn't crash Outlook, it will just slow your computer down. Make sure there are not Adobe addins in Outlook.
Disable the HyperSnap-DX 5 screen capture from starting up. Run it when you need to.
The osaio.sys error, file cannot be found: This is software from Velocity Micro that is supplied to Intel. It is a utility used for monitoring hardware. If you uninstalled the software, the registry entries are not removed and still point to the program hence, the popup stating that the file could not be found. see the post from Osaio
http://www.computergripes.com/velocity.micro.html
I would disable the Windows Desktop search as part of the trouble shooting process.
Right-Click on My Computer and select manage
Click on Services and Applications
Click on Services
Find the Windows Search service, right-click on it and choose stop.
You have to go under the assumption that on a clean computer, barring any hardware problems or corrupted software, Outlook will function correctly.
Let us know how you do,
cheers,
frankco
Internet Explorer is what Outlook uses to view your HTML emails. It is tied directly to Outlook.
You have a lot going on when your computer starts. I think this will be a process of elimination. Some applications may not work well with OL2007. For instance, Adobe PDF addin is not compatible with 2007. It doesn’t crash OL, it just doesn’t work. As far as the other programs you have running, you will have to remove them or disable them to check.
You should get rid of the toolbar helpers. Yahoo, Google.
I haven’t used GRISOFT anti virus software and don’t know how it plays with OL 2007. I would suggest that you run version 7.5 if you are not or disable it.
Do you need a password manager? If you can live without it, uninstall RoboForm.
Remove the Adobe Speed launcher from your startup folder. Right click it and delete the shortcut. this shouldn't crash Outlook, it will just slow your computer down. Make sure there are not Adobe addins in Outlook.
Disable the HyperSnap-DX 5 screen capture from starting up. Run it when you need to.
The osaio.sys error, file cannot be found: This is software from Velocity Micro that is supplied to Intel. It is a utility used for monitoring hardware. If you uninstalled the software, the registry entries are not removed and still point to the program hence, the popup stating that the file could not be found. see the post from Osaio
http://www.computergripes.com/velocity.micro.html
I would disable the Windows Desktop search as part of the trouble shooting process.
Right-Click on My Computer and select manage
Click on Services and Applications
Click on Services
Find the Windows Search service, right-click on it and choose stop.
You have to go under the assumption that on a clean computer, barring any hardware problems or corrupted software, Outlook will function correctly.
Let us know how you do,
cheers,
frankco
ASKER
Ok - frankco, thanks - let me study your response and see what I can do. I'll be back, hopefully tomorrow.
Jeff
Jeff
ASKER
frankco - following up on the IE connection to Outlook, I came across this:
http://www.campaignmonitor.com/blog/archives/2007/01/microsoft_takes_email_design_b.html
"Outlook 2007... will stop using Internet Explorer to render HTML emails and instead use the crippled Microsoft Word rendering engine".
That being said, is there any further reason to make IE7 my default browser as we discussed previously?
Jeff
http://www.campaignmonitor.com/blog/archives/2007/01/microsoft_takes_email_design_b.html
"Outlook 2007... will stop using Internet Explorer to render HTML emails and instead use the crippled Microsoft Word rendering engine".
That being said, is there any further reason to make IE7 my default browser as we discussed previously?
Jeff
ASKER
Don't know if it means anything or not (because I have no idea if any of these issues were connected), so just for an FYI:
I believe the issue of my slave drive not being visible in Windows Explorer (unless I did a cold boot) is solved (when it was hooked up, it used an intermediate connection to the power supply - I switched it to the end connection on the cable to the power supply and that seems to have cured it. I wouldn't have thought that would make a difference ... maybe it just didn't have a solid connection before, but anyway, it seems to be working on a system restart now.
Also, I have to say (knock on wood) that not only has my internet connection been stable for the last couple of days but I also haven't had a repeat of Outlook closing unexpectedly since I started this thread ... six days ago.
Jeff
I believe the issue of my slave drive not being visible in Windows Explorer (unless I did a cold boot) is solved (when it was hooked up, it used an intermediate connection to the power supply - I switched it to the end connection on the cable to the power supply and that seems to have cured it. I wouldn't have thought that would make a difference ... maybe it just didn't have a solid connection before, but anyway, it seems to be working on a system restart now.
Also, I have to say (knock on wood) that not only has my internet connection been stable for the last couple of days but I also haven't had a repeat of Outlook closing unexpectedly since I started this thread ... six days ago.
Jeff
Jeff, sounds like your hardware issue might have fixed it. Also, you may have gotten an update to your AV (or any of your security programs) that might have been mucking with Outlook.
But if you feel like Frankco's assistance didn't help rectify your problem and you would like to get your points refunded, simply start a new question and place it in to the https://www.experts-exchange.com/Community_Support/General/#browseZones
Community Support - General area and put a link to this question in it so you can get your points back. You just put a zero point refund question there.
But if you feel like Frankco's assistance didn't help rectify your problem and you would like to get your points refunded, simply start a new question and place it in to the https://www.experts-exchange.com/Community_Support/General/#browseZones
Community Support - General area and put a link to this question in it so you can get your points back. You just put a zero point refund question there.
ASKER
I spoke too soon, thinking my problem had been solved because the IDE drive had been through a few restart cycles and was visible each time. However, yesterday, the problem surfaced again with the drive not visible on a restart ... yet it showed up on a cold boot. This morning, I replaced the IDE cable and, so far, it's recognized the drive on a restart, but it's only been through one cycle.
Additionally, all Outlook windows closed on me yesterday afternnon with no warning or errors (after 8 days of use). I've since made inactive all Outlook Add-Ins except for"Windows Search Email Indexer". Before turning that off, I wanted to ask if this was related to Windows Desktop Search or not? IF so, then turning it off (AND followiing frankco's advice to also disable Windows Desktop Search) would seem to cripple any ability to search my Outlook.pst file, wouldn't it? I'd surely like to maintain the WDS as it does come in handy ...
I also had another total system crash today with Event ID 1001 reporting:
"The computer has rebooted from a bugcheck. The bugcheck was: 0x100000d1 (0x0298e968, 0x00000002, 0x00000000, 0xf89c4a59). A dump was saved in: C:\WINDOWS\Minidump\Mini04
... this happened when I was away from the PC and nothing should have been active (that is, I left the computer running with several apps up, but none of them were currently being used by me ... of course, email could have been received during this time but outside of that, I don't think there could have been any active I/O going on ...
Jeff
Additionally, all Outlook windows closed on me yesterday afternnon with no warning or errors (after 8 days of use). I've since made inactive all Outlook Add-Ins except for"Windows Search Email Indexer". Before turning that off, I wanted to ask if this was related to Windows Desktop Search or not? IF so, then turning it off (AND followiing frankco's advice to also disable Windows Desktop Search) would seem to cripple any ability to search my Outlook.pst file, wouldn't it? I'd surely like to maintain the WDS as it does come in handy ...
I also had another total system crash today with Event ID 1001 reporting:
"The computer has rebooted from a bugcheck. The bugcheck was: 0x100000d1 (0x0298e968, 0x00000002, 0x00000000, 0xf89c4a59). A dump was saved in: C:\WINDOWS\Minidump\Mini04
... this happened when I was away from the PC and nothing should have been active (that is, I left the computer running with several apps up, but none of them were currently being used by me ... of course, email could have been received during this time but outside of that, I don't think there could have been any active I/O going on ...
Jeff
For the time being, why not move your virtual memory back to your main hard drive and see if the crashes stop?
If your system isn't always seeing your second hard drive for some reason, but your virtual memory is supposed to be there, I can certainly see why you are slogging down and crashing.
Keep in mind 512 MB Ram is a little light on Win XP especially running Outlook and other programs simultaneously.
If your system isn't always seeing your second hard drive for some reason, but your virtual memory is supposed to be there, I can certainly see why you are slogging down and crashing.
Keep in mind 512 MB Ram is a little light on Win XP especially running Outlook and other programs simultaneously.
I don't know if you all have had any luck finding a solution, but we have an almost idendentical problem (forgive the grammar). This seems to happen anytime the user clicks on forward or reply. So far, has not noticed it on any other functions of outlook. It does not happen all of the time and the error logs look very similar to those noted by the initial questioner here. This is on a Vista Machine (32bit) with Office 2007 pro. If it sweetens the pot, I would gladly post this as a second question and award points as well. I don't know if that is "copasetic (sp?)."
Thanks,
Blaine
Thanks,
Blaine
ASKER
mtz1of4:
> For the time being, why not move your virtual memory back to your main hard drive and see if the crashes stop? If your system isn't always seeing your second hard drive for some reason, but your virtual memory is supposed to be there, I can certainly see why you are slogging down and crashing.
When the slave drive hasn't been visible, I note it right away on restart and do a cold boot right away so the other problems I'm having here are not due to not having the Virtual Memory available. That said, is there any other reason I ought to relocate the pagefile.sys entirely back on the master HD?
I've also been trying to use verifier.exe to see if I can find any drivers that are faulty but haven't had too much luck with that yet. In the meantime, I've had two more total system crashes with black screen stop messages:
1) IO System Error in NTIdrvr.sys (WDM Driver Error 224) NTIDrvr.sys+dce at F8963DCE
2) PAGE_FAULT_IN_NONPAGED_ARE
STOP: 0X00000050
I think the first of these was probably due to the stresses introduced by verifier.exe (but I'm not sure - too many damn crashes going on here for me to keep up with all of them ...). The second crash did not have any drivers enabled in verifier.exe ...
BTW, in my travels concerning all of the issues I have been seeing here, I came across this post at:
http://www.techspot.com/vb/topic44306.html
"You want to check how many volts your PSU is putting out on the various “rails”. There is the 3.3v, the 5v and the 12v and the readings shouldn't deviate more than 5 or 6%. Note, this 5-6% rule only applies to the +3.3v, +5v and +12v rails (not the negative rails)."
Using SpeedFan (http://www.almico.com/speedfan.php), I am consistently getting a reading of 4.86V on the 12 volt rail (a deviation of nearly 60% from spec). I don't know everything that runs off the 12 volt rail, but I am wondering whether this could affect any of the issues I am seeing here or is otherwise a cause for concern. Can anyone speak to this?
Jeff
> For the time being, why not move your virtual memory back to your main hard drive and see if the crashes stop? If your system isn't always seeing your second hard drive for some reason, but your virtual memory is supposed to be there, I can certainly see why you are slogging down and crashing.
When the slave drive hasn't been visible, I note it right away on restart and do a cold boot right away so the other problems I'm having here are not due to not having the Virtual Memory available. That said, is there any other reason I ought to relocate the pagefile.sys entirely back on the master HD?
I've also been trying to use verifier.exe to see if I can find any drivers that are faulty but haven't had too much luck with that yet. In the meantime, I've had two more total system crashes with black screen stop messages:
1) IO System Error in NTIdrvr.sys (WDM Driver Error 224) NTIDrvr.sys+dce at F8963DCE
2) PAGE_FAULT_IN_NONPAGED_ARE
STOP: 0X00000050
I think the first of these was probably due to the stresses introduced by verifier.exe (but I'm not sure - too many damn crashes going on here for me to keep up with all of them ...). The second crash did not have any drivers enabled in verifier.exe ...
BTW, in my travels concerning all of the issues I have been seeing here, I came across this post at:
http://www.techspot.com/vb/topic44306.html
"You want to check how many volts your PSU is putting out on the various “rails”. There is the 3.3v, the 5v and the 12v and the readings shouldn't deviate more than 5 or 6%. Note, this 5-6% rule only applies to the +3.3v, +5v and +12v rails (not the negative rails)."
Using SpeedFan (http://www.almico.com/speedfan.php), I am consistently getting a reading of 4.86V on the 12 volt rail (a deviation of nearly 60% from spec). I don't know everything that runs off the 12 volt rail, but I am wondering whether this could affect any of the issues I am seeing here or is otherwise a cause for concern. Can anyone speak to this?
Jeff
Jeff said, "When the slave drive hasn't been visible, I note it right away on restart and do a cold boot right away so the other problems I'm having here are not due to not having the Virtual Memory available. That said, is there any other reason I ought to relocate the pagefile.sys entirely back on the master HD?"
Yes, for some reason, the slave drive keeps disappearing. This is a bad thing.
You are jumping all over the place so it is hard to follow, but I will try.
The first thing that jumps out at me currently is "Is this thing under warranty?"
As far as Speedfan - Is it set up properly? If you are pulling 5 Volts from the 12 Volts, then yes, you have a problem. I haven't used Speedfan so I can't explain if it is set up wrong or not.
Also, it looks like you'll want to confirm you have the best driver for your video card.
1) IO System Error in NTIdrvr.sys (WDM Driver Error 224) NTIDrvr.sys+dce at F8963DCE
Windows Desktop Search - With the amount of physical RAM you have, I would certainly disable, if not uninstall any stressful programs that want to sit and run in the background like that one. Google Desktop Search also.
Personally, you need to install more RAM, if you want to load so many programs at once.
Have you tried running msconfig and going to the Startup tab and unchecking any of your programs?
By the way, with all these stop errors running around, you better make sure you have all your important files backed up OFF the hard drive.
It sounds like it's ready for a complete reformat and reinstall.
Yes, for some reason, the slave drive keeps disappearing. This is a bad thing.
You are jumping all over the place so it is hard to follow, but I will try.
The first thing that jumps out at me currently is "Is this thing under warranty?"
As far as Speedfan - Is it set up properly? If you are pulling 5 Volts from the 12 Volts, then yes, you have a problem. I haven't used Speedfan so I can't explain if it is set up wrong or not.
Also, it looks like you'll want to confirm you have the best driver for your video card.
1) IO System Error in NTIdrvr.sys (WDM Driver Error 224) NTIDrvr.sys+dce at F8963DCE
Windows Desktop Search - With the amount of physical RAM you have, I would certainly disable, if not uninstall any stressful programs that want to sit and run in the background like that one. Google Desktop Search also.
Personally, you need to install more RAM, if you want to load so many programs at once.
Have you tried running msconfig and going to the Startup tab and unchecking any of your programs?
By the way, with all these stop errors running around, you better make sure you have all your important files backed up OFF the hard drive.
It sounds like it's ready for a complete reformat and reinstall.
Definitely uninstall your Search assistants.
I'll be gone till Wednesday. Hopefully someone will be able to help you out.
I'll be gone till Wednesday. Hopefully someone will be able to help you out.
ASKER
mtz1of4:
>>" That said, is there any other reason I ought to relocate the pagefile.sys entirely back on the master HD?"
> Yes, for some reason, the slave drive keeps disappearing. This is a bad thing.
I may not have been clear on this - The slave drive doesn't disappear WHILE I am using it - it had been failing to be recognized on a re-start (and when that happened, it was immediately apparent and I would do a cold boot to bring the drive back to life - subsequently, the drive never failed in use for the life of the session). Also, since replacing the IDE cable, I haven't had any recurrence of the drive failing to appear on a restart.
> As far as Speedfan - Is it set up properly?
The SpeedFan voltage readings were automatically returned when I ran the software - unless there is a bad sensor, I don't know what else would cause this.
> Also, it looks like you'll want to confirm you have the best driver for your video card.
1) IO System Error in NTIdrvr.sys (WDM Driver Error 224) NTIDrvr.sys+dce at F8963DCE
I'm not sure why you belive this error is related to my video card - I **believe** this driver is related to the "NTI CD & DVD-Maker" and/or the "NTI Backup Now!" software that came bundled with this PC.
But funny you should mention this possibility as the only driver update (I think) I've done is in the "video area" (and here, I confess to being a little confused as to where the "video card" leaves off and the "Intel Express Chipset" terminology begins). Nevertheless, back when I got the 0xD1 STOP Error (“DRIVER_IRQL_NOT_LESS_OR_
Detected Chipset:
Intel(R) 946GZ Express Chipset
Chipset Components:
Memory Controller:
82946GZ
I/O Controller:
Intel(R) 82801GB/GR I/O controller hub (ICH7/ICH7R) SATA Controller found in IDE mode
So, a long way to say I don't know if any of that is relevant but I am passing it on, just in case.
> Windows Desktop Search - With the amount of physical RAM you have, I would certainly disable, if not uninstall any stressful programs that want to sit and run in the background like that one. Google Desktop Search also.
Process Explorer reports that Windows Desktop Search has a "Working Set" of 716K, a "Peak Working Set" of 11,980K and a "Virtual Size" of 77,136K (all over the last 51 hours since this session began). In this session, I've also had a peak usage of 838MB (55%) of the 1,536MB in my pagefile.sys. I expect that when either Indexing or a Search is in process, the usage peaks, but otherwise, just sitting in the background with a "Working Set" of 716K of memory doesn't seem like a lot of overhead for a program I find useful ... not trying to be difficult here - rather, I'm just trying to better understand what I'm up against and how to best make these decisions ...
> Personally, you need to install more RAM, if you want to load so many programs at once.
Well, I won't dispute that more RAM would be helpful here but $ is an issue right now ... so will have to delay that for a while. Still, an Acer memory Utility indicates "You do not need to upgrade memory" even though I've always run quite a few applications simultaneously.
> Have you tried running msconfig and going to the Startup tab and unchecking any of your programs?
Yes, I've been through that routine. Of the programs frankco mentioned disabling:
> You should get rid of the toolbar helpers. Yahoo, Google
I've ditched Yahoo but I really use the Google Toolbar quite often in researching key words in the Search Term so haven't turned the Google TB off yet.
> Do you need a password manager? If you can live without it, uninstall RoboForm.
Yeah, I do need the password manager (well, "need" is a relative word but it certainly comes in handy with all of the sites I visit). Process Explorer reports that it has a "Working Set" of 2396K, a "Peak Working Set" of 7,396K and a "Virtual Size" of 56,640K (also over the last 51 hours since this session began).
> Remove the Adobe Speed launcher from your startup folder. - Done
> Make sure there are not Adobe addins in Outlook. - Done
> Disable the HyperSnap-DX 5 screen capture from starting up. Run it when you need to.
This is a utility I frequently use - Process Explorer reports that it has a "Working Set" of 2,180K, a "Peak Working Set" of 18,516K and a "Virtual Size" of 142,916K (again, over the last 51 hours since this session began).
BTW, since I had overlooked responding to frankco's comment on same earlier, I am using the latest version (7.5) of GRISOFT's AVG anti virus software.
> By the way, with all these stop errors running around, you better make sure you have all your important files backed up OFF the hard drive.
Thanks, I've got that covered between the two hard drives.
I am beginning to think checking on a warranty replacement / repair may be in order (although I'm kind of dreading starting all over again), especially when I don't know what has gotten this new PC in this kind of trouble in less than 3 months time ...
Jeff
>>" That said, is there any other reason I ought to relocate the pagefile.sys entirely back on the master HD?"
> Yes, for some reason, the slave drive keeps disappearing. This is a bad thing.
I may not have been clear on this - The slave drive doesn't disappear WHILE I am using it - it had been failing to be recognized on a re-start (and when that happened, it was immediately apparent and I would do a cold boot to bring the drive back to life - subsequently, the drive never failed in use for the life of the session). Also, since replacing the IDE cable, I haven't had any recurrence of the drive failing to appear on a restart.
> As far as Speedfan - Is it set up properly?
The SpeedFan voltage readings were automatically returned when I ran the software - unless there is a bad sensor, I don't know what else would cause this.
> Also, it looks like you'll want to confirm you have the best driver for your video card.
1) IO System Error in NTIdrvr.sys (WDM Driver Error 224) NTIDrvr.sys+dce at F8963DCE
I'm not sure why you belive this error is related to my video card - I **believe** this driver is related to the "NTI CD & DVD-Maker" and/or the "NTI Backup Now!" software that came bundled with this PC.
But funny you should mention this possibility as the only driver update (I think) I've done is in the "video area" (and here, I confess to being a little confused as to where the "video card" leaves off and the "Intel Express Chipset" terminology begins). Nevertheless, back when I got the 0xD1 STOP Error (“DRIVER_IRQL_NOT_LESS_OR_
Detected Chipset:
Intel(R) 946GZ Express Chipset
Chipset Components:
Memory Controller:
82946GZ
I/O Controller:
Intel(R) 82801GB/GR I/O controller hub (ICH7/ICH7R) SATA Controller found in IDE mode
So, a long way to say I don't know if any of that is relevant but I am passing it on, just in case.
> Windows Desktop Search - With the amount of physical RAM you have, I would certainly disable, if not uninstall any stressful programs that want to sit and run in the background like that one. Google Desktop Search also.
Process Explorer reports that Windows Desktop Search has a "Working Set" of 716K, a "Peak Working Set" of 11,980K and a "Virtual Size" of 77,136K (all over the last 51 hours since this session began). In this session, I've also had a peak usage of 838MB (55%) of the 1,536MB in my pagefile.sys. I expect that when either Indexing or a Search is in process, the usage peaks, but otherwise, just sitting in the background with a "Working Set" of 716K of memory doesn't seem like a lot of overhead for a program I find useful ... not trying to be difficult here - rather, I'm just trying to better understand what I'm up against and how to best make these decisions ...
> Personally, you need to install more RAM, if you want to load so many programs at once.
Well, I won't dispute that more RAM would be helpful here but $ is an issue right now ... so will have to delay that for a while. Still, an Acer memory Utility indicates "You do not need to upgrade memory" even though I've always run quite a few applications simultaneously.
> Have you tried running msconfig and going to the Startup tab and unchecking any of your programs?
Yes, I've been through that routine. Of the programs frankco mentioned disabling:
> You should get rid of the toolbar helpers. Yahoo, Google
I've ditched Yahoo but I really use the Google Toolbar quite often in researching key words in the Search Term so haven't turned the Google TB off yet.
> Do you need a password manager? If you can live without it, uninstall RoboForm.
Yeah, I do need the password manager (well, "need" is a relative word but it certainly comes in handy with all of the sites I visit). Process Explorer reports that it has a "Working Set" of 2396K, a "Peak Working Set" of 7,396K and a "Virtual Size" of 56,640K (also over the last 51 hours since this session began).
> Remove the Adobe Speed launcher from your startup folder. - Done
> Make sure there are not Adobe addins in Outlook. - Done
> Disable the HyperSnap-DX 5 screen capture from starting up. Run it when you need to.
This is a utility I frequently use - Process Explorer reports that it has a "Working Set" of 2,180K, a "Peak Working Set" of 18,516K and a "Virtual Size" of 142,916K (again, over the last 51 hours since this session began).
BTW, since I had overlooked responding to frankco's comment on same earlier, I am using the latest version (7.5) of GRISOFT's AVG anti virus software.
> By the way, with all these stop errors running around, you better make sure you have all your important files backed up OFF the hard drive.
Thanks, I've got that covered between the two hard drives.
I am beginning to think checking on a warranty replacement / repair may be in order (although I'm kind of dreading starting all over again), especially when I don't know what has gotten this new PC in this kind of trouble in less than 3 months time ...
Jeff
You're right, ntidrvr.sys seems to be related to your DVD Driver. So please make sure you are up to date on that driver or software.
Roboform is definitely a keeper. Use it myself.
Are there any help files or forums for Speedfan? As I said, 5 volts when you require 12 is not good.
Did you install Program Checker Pro?
Roboform is definitely a keeper. Use it myself.
Are there any help files or forums for Speedfan? As I said, 5 volts when you require 12 is not good.
Did you install Program Checker Pro?
ASKER
Checked for SpeedFan forums but didn't find any dedicated to same. Found some posts elsewhere that suggested that such software diagnostic tools may not be reliable but got the same 4.86v reading on the 12 volt rail from Everest. So, don't know what to make of this ...
I have installed Program Checker - is there some specific file I should be checking with this?
Correcting my earlier post:
I had said that I had updated my video driver from "Intel 82801GB ICH7" to "Intel(R) 946GZ Express Chipset" - acutally, the original driver was also "Intel(R) 946GZ Express Chipset" but just an earlier (6/23/06) version and I had just updated that to the 2/27/07 version I found on the Intel site (not sure where the "Intel 82801GB ICH7" reference came from now or why it is referenced as such on the SpeedFan Info tab). Anyway, after contacting Acer support, they advised I shouldn't have updated to that 2/27/07 version as it was untested with this system, so I rolled it back to the 6/23/06 version a couple of days ago. Since then, I've had no BSOD's or STOP errors although I have had Outlook 2007 close all OL windows without warning or error ... this happened the last time when I right-clicked on an email button on the Task Bar and clicked Close - all OL windows then closed (the only OL add-in installed was Windows Search Email Indexer ...).
Jeff
I have installed Program Checker - is there some specific file I should be checking with this?
Correcting my earlier post:
I had said that I had updated my video driver from "Intel 82801GB ICH7" to "Intel(R) 946GZ Express Chipset" - acutally, the original driver was also "Intel(R) 946GZ Express Chipset" but just an earlier (6/23/06) version and I had just updated that to the 2/27/07 version I found on the Intel site (not sure where the "Intel 82801GB ICH7" reference came from now or why it is referenced as such on the SpeedFan Info tab). Anyway, after contacting Acer support, they advised I shouldn't have updated to that 2/27/07 version as it was untested with this system, so I rolled it back to the 6/23/06 version a couple of days ago. Since then, I've had no BSOD's or STOP errors although I have had Outlook 2007 close all OL windows without warning or error ... this happened the last time when I right-clicked on an email button on the Task Bar and clicked Close - all OL windows then closed (the only OL add-in installed was Windows Search Email Indexer ...).
Jeff
"I have installed Program Checker - is there some specific file I should be checking with this?"
No, This program is unknown to me. It sounded more like spyware/malware. I didn't find any reliable info on it, so I inquired.
What happens if you disable that OL add-in? Does Outlook then crash on you?
No, This program is unknown to me. It sounded more like spyware/malware. I didn't find any reliable info on it, so I inquired.
What happens if you disable that OL add-in? Does Outlook then crash on you?
ASKER
Yes, I did install Program Checker (from http://www.programchecker.com/) ... within the last 2 weeks or so as part of several tools I've downloaded trying to run down all the issues reported in this topic. Can't say it's been of much help (I've only used it on a couple of files and they seemingly weren't in its database), but I haven't seen anything indicating it might be spyware ...
It's verified as "Legitimate" by Castlecops (http://www.castlecops.com/o23list-1647.html ) for what that's worth.
I just now disabled the "Windows Search Email Indexer" Outlook Add-in ... I had been reluctant to turn that one off because I thought it might have been tied in to the Windows Desktop Search tool which I have found pretty useful in finding things that other Search tools seem to miss even though I know they are there. However, I tested the Windows Desktop Search on a new email created with the "Windows Search Email Indexer" Outlook Add-in turned off and it found it, so it appears they are not related. We'll see if OL can stay open when it's supposed to now (although it may be a while before I'll feel comfortable saying that - I had gone 8 days without the OL crash at one time during this thread ...). But I will come back to this when I have more to report ... Thanks for sticking with this!
Jeff
It's verified as "Legitimate" by Castlecops (http://www.castlecops.com/o23list-1647.html ) for what that's worth.
I just now disabled the "Windows Search Email Indexer" Outlook Add-in ... I had been reluctant to turn that one off because I thought it might have been tied in to the Windows Desktop Search tool which I have found pretty useful in finding things that other Search tools seem to miss even though I know they are there. However, I tested the Windows Desktop Search on a new email created with the "Windows Search Email Indexer" Outlook Add-in turned off and it found it, so it appears they are not related. We'll see if OL can stay open when it's supposed to now (although it may be a while before I'll feel comfortable saying that - I had gone 8 days without the OL crash at one time during this thread ...). But I will come back to this when I have more to report ... Thanks for sticking with this!
Jeff
Thanks for the updates.
ASKER
Ok - with NO Add-ins active in OL, OL 2007 is still crashing on me, and closing all open OL windows with no warning. The only thing I can find is this entry in Event Viewer | Microsoft Office Sessions:
ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session was terminated unexpectedly.
This behavior is seemingly invoked by right-clicking on an OL item (Say an email) and clicking 'Close', although it doesn't happen everytime I do that ...
Jeff
ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session was terminated unexpectedly.
This behavior is seemingly invoked by right-clicking on an OL item (Say an email) and clicking 'Close', although it doesn't happen everytime I do that ...
Jeff
"This behavior is seemingly invoked by right-clicking on an OL item"
Sounds like a shell issue.
Take a look at this page.
http://windowsxp.mvps.org/slowrightclick.htm
Sounds like a shell issue.
Take a look at this page.
http://windowsxp.mvps.org/slowrightclick.htm
ASKER
Well, I explored that issue and disabled a couple of right-click extensions that weren't necessary but don't really think the issue discussed at that link is causing my problem. I don't have any of the listed symptoms other than an occasional "Error message "Windows Explorer has encountered a problem and needs to close. We are sorry for the inconvenience" when you right-click a folder."
I also ran the System File Checker for good measure, but don't know if that found/corrected anything - no log is generated from that that I know of ...
Jeff
I also ran the System File Checker for good measure, but don't know if that found/corrected anything - no log is generated from that that I know of ...
Jeff
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Ok - I turned off DEP for OL several hours ago and after re-booting, I've had no further OL crashes. While it hasn't been running for very long, I have had several OL windows open and have closed several of them via right-clicks to the task bar button. So far, it's stable ... I'll keep you posted.
Jeff
Jeff
Thanks, I'll be around.
ASKER
Ok - OL stayed stable for about 61 hours before crashing today when I right-clicked and clicked close on an email button on the task bar& click. At the time, my FireFox browser had temporarily frozen when I was clicking on a sub-folder in my Bookmarks menu. It took a minute or so for that to clear up and it was during that time that OL closed ... don't know if the two actions had any relationship.
Jeff
Jeff
Anything telling in Event log?
Just for giggles, would you mind downloading and running
http://www.nirsoft.net/utils/shexview.html
when it runs, let me know if you get any shell extensions marked in RED. If you don't you can delete the program if you like.
I believe you mentioned having Process Explorer, without rebooting, Could you open that once and click on View->System Information and give me the numbers you have listed for Physical Memory
Total
and the numbers you have for Commit Charge
Current -
Limit -
Peak -
Of course, you could have Outlook and firefox open when you do that, if you desire.
Just for giggles, would you mind downloading and running
http://www.nirsoft.net/utils/shexview.html
when it runs, let me know if you get any shell extensions marked in RED. If you don't you can delete the program if you like.
I believe you mentioned having Process Explorer, without rebooting, Could you open that once and click on View->System Information and give me the numbers you have listed for Physical Memory
Total
and the numbers you have for Commit Charge
Current -
Limit -
Peak -
Of course, you could have Outlook and firefox open when you do that, if you desire.
ASKER
Event Viewer | Microsoft Office Sessions: "ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session was terminated unexpectedly." Nothing enlightening there ... same message I've seen previously.
I will download the shexview and advise as well as provide the memory info, but will need to re-boot first. I just upgraded to FireFox 2.0 with the hopes that the supposedly more stable browser might affect this issue favorably (if there's any relationship).
Jeff
I will download the shexview and advise as well as provide the memory info, but will need to re-boot first. I just upgraded to FireFox 2.0 with the hopes that the supposedly more stable browser might affect this issue favorably (if there's any relationship).
Jeff
Just keep in mind, that with the reboot, it will free all memory and change the Peak value of the Commit Charge, so we may have to look at it again after a couple days uptime or at next crash.
One ? I never asked.
How large is your .pst file? Maybe outlook 2007 needs a new, smaller profile to go with the newer version. When you upgraded to 2007, I'm sure you just used the previous profile, correct?
http://support.microsoft.com/kb/932086/en-us
One ? I never asked.
How large is your .pst file? Maybe outlook 2007 needs a new, smaller profile to go with the newer version. When you upgraded to 2007, I'm sure you just used the previous profile, correct?
http://support.microsoft.com/kb/932086/en-us
ASKER
ShellExView shows two highlighted in Red:
#1:
&Google No IE Toolbar Google IE Client Toolbar 4, 0, 1601, 4978 Google Toolbar for IE Google Inc. No No No c:\program files\google\googletoolbar
#2:
Google Toolbar Helper No Browser Helper Object Google IE Client Toolbar 4, 0, 1601, 4978 Google Toolbar for IE Google Inc. No No No c:\program files\google\googletoolbar
With the programs I normally will have running at any given time, Process Explorer presently shows:
Physical Memory
Total 514.476
and the numbers you have for Commit Charge
Current - 749.,952
Limit - 2,055,780
Peak - 752,628
My pst file is 1 GB but I also have another archived file that is 745 MB. Yes, I did use my previous profile when you upgraded to 2007. I'm in the process of re-booting after installing the MS update mentioned at the URL you suggested.
Jeff
#1:
&Google No IE Toolbar Google IE Client Toolbar 4, 0, 1601, 4978 Google Toolbar for IE Google Inc. No No No c:\program files\google\googletoolbar
#2:
Google Toolbar Helper No Browser Helper Object Google IE Client Toolbar 4, 0, 1601, 4978 Google Toolbar for IE Google Inc. No No No c:\program files\google\googletoolbar
With the programs I normally will have running at any given time, Process Explorer presently shows:
Physical Memory
Total 514.476
and the numbers you have for Commit Charge
Current - 749.,952
Limit - 2,055,780
Peak - 752,628
My pst file is 1 GB but I also have another archived file that is 745 MB. Yes, I did use my previous profile when you upgraded to 2007. I'm in the process of re-booting after installing the MS update mentioned at the URL you suggested.
Jeff
I thought you uninstalled google toolbar. At the very least, make sure you have the very latest google toolbar if you really need it.
ASKER
No - I didn't uninstall the Google Toolbar - I find it too useful to do that unless I know it is causing the problem ... I have options configured for automatic updates.
Unfortunately, while installing the MS update mentioned at the URL you suggested above, I encountered another STOP error: PAGE_FAULT_IN_NONPAGED_ARE
Jeff
Unfortunately, while installing the MS update mentioned at the URL you suggested above, I encountered another STOP error: PAGE_FAULT_IN_NONPAGED_ARE
Jeff
"No - I didn't uninstall the Google Toolbar - I find it too useful to do that unless I know it is causing the problem"
The only way to find out if it is causing the problem is to eliminate either the problem (which appears to be blue screens, correct?) or the cause of the problem.
Since we cannot identify the problem, we must troubleshoot.
One of the most important steps in troubleshooting is eliminating. If you eliminate this one program even for a day and you blue screen, then go ahead and reinstall it, but if you can't live for a day without it, then I'm probably done helping.
I could tell you to reformat the entire drive and reinstall everything from scratch. That will fix everything, but if you want to try to identify the problem, you have to be willing to work with us.
I understand your frustration. I'll give it some more thought on Monday. Have a good weekend.
The only way to find out if it is causing the problem is to eliminate either the problem (which appears to be blue screens, correct?) or the cause of the problem.
Since we cannot identify the problem, we must troubleshoot.
One of the most important steps in troubleshooting is eliminating. If you eliminate this one program even for a day and you blue screen, then go ahead and reinstall it, but if you can't live for a day without it, then I'm probably done helping.
I could tell you to reformat the entire drive and reinstall everything from scratch. That will fix everything, but if you want to try to identify the problem, you have to be willing to work with us.
I understand your frustration. I'll give it some more thought on Monday. Have a good weekend.
ASKER
Sorry, mtz1of4 - I didn't mean to come across as uncooperative - I know this must be frustrating for you, too, to have a question stay open as long as this one has. I disabled the 2 Google entries in ShellExView but surprisingly, the Google Toolbar functionality is still present in my FireFox 2.0 browser although it cannot be turned on in IE. The FireFox browser lists Google and GooglePlus Toolbars although th e former is blank when I turn it on because I customized the buttons I wanted available by dragging them to the GooglePlus Toolbar. Was this sufficient to disable these Google entries in ShellExView? Or do I need to uninstall the related apps?
Jeff
Jeff
Jeff,
According to the shellexview notes, any lines in RED indicate "If ShellExView detect shell extension with unusual file extension or with unusual attribute (e.g: shell extension dll that is marked as hidden in the file system), it'll be marked in red
color. It's recommended to deeply check these unusual shell extensions to
insure that they are not unwanted malicious programs that penetrated into
your system."
honestly, I have only tried Google toolbar once and it caused me issues that outweighed the benefits so I uninstalled it and haven't looked back. So I can't say if simply disabling them in the shellexview program will be enough. Doesn't look like it though. After reading through some of Google's pages, the tool bar is installed in both browsers separately.
Let's take a look at your Google toolbar versions for Firefox. Version 2.1.20060807 was supposed to fix some hard drive thrashing.
I'm going off base again. Do you have the google desktop search installed?
If this were my machine and I was bluescreening 4 times a day, I would consider uninstalling everything before I would did a reformat and reinstall.
We could also run a Memtester over night to see if it shows anything.
I can't imagine you want to spend every waking moment getting this thing working properly so I can offer a few quickies.
1. Uninstall Google desktop and Windows Desktop search if you have it installed.
2. Repost a Hijackthis log here.
3. Download and run both of these programs to test out your computer's memory.
http://oca.microsoft.com/en/windiag.asp and http://www.memtest.org/
these two seem to be pretty reliable. If I remember correctly, memtest86+ may take an overnight run.
According to the shellexview notes, any lines in RED indicate "If ShellExView detect shell extension with unusual file extension or with unusual attribute (e.g: shell extension dll that is marked as hidden in the file system), it'll be marked in red
color. It's recommended to deeply check these unusual shell extensions to
insure that they are not unwanted malicious programs that penetrated into
your system."
honestly, I have only tried Google toolbar once and it caused me issues that outweighed the benefits so I uninstalled it and haven't looked back. So I can't say if simply disabling them in the shellexview program will be enough. Doesn't look like it though. After reading through some of Google's pages, the tool bar is installed in both browsers separately.
Let's take a look at your Google toolbar versions for Firefox. Version 2.1.20060807 was supposed to fix some hard drive thrashing.
I'm going off base again. Do you have the google desktop search installed?
If this were my machine and I was bluescreening 4 times a day, I would consider uninstalling everything before I would did a reformat and reinstall.
We could also run a Memtester over night to see if it shows anything.
I can't imagine you want to spend every waking moment getting this thing working properly so I can offer a few quickies.
1. Uninstall Google desktop and Windows Desktop search if you have it installed.
2. Repost a Hijackthis log here.
3. Download and run both of these programs to test out your computer's memory.
http://oca.microsoft.com/en/windiag.asp and http://www.memtest.org/
these two seem to be pretty reliable. If I remember correctly, memtest86+ may take an overnight run.
ASKER
> Do you have the google desktop search installed?
No, I don't have GDS installed, although I do have Windows Desktop Search.
> If this were my machine and I was bluescreening 4 times a day, I would consider uninstalling everything before I would did a reformat and reinstall.
Well, it's not quite that bad (4x daily) - although I did have 4 of them when trying to install that Outlook Update 933493 you referred me to as well as a subsequent run of Office Diagnostics. Before that, however I had gone 3 weeks without any BSODs.
> 1. Uninstall Google desktop and Windows Desktop Search if you have it installed.
> 2. Repost a Hijackthis log here.
I'm away from the PC with the problems today so tomorrow will be the earliest chance I'll have to try these two steps. Do I need to uninstall WDS or just stop it from starting automatically on boot?
> 3. Download and run both of these programs to test out your computer's memory.
http://oca.microsoft.com/en/windiag.asp and http://www.memtest.org/
these two seem to be pretty reliable. If I remember correctly, memtest86+ may take an overnight run.
Somewhere in my travels on this issue, I had previously run memtest86 for 7-8 hours (or was it "passes"?) and had no errors. I also had downloaded the windiag utility though I don't remember anything about the results of same ... if I had had any errors, I would have remembered but it's possible I didn't run it with everything else going on. I'll check that out, too, when I have the PC available again.
Jeff
No, I don't have GDS installed, although I do have Windows Desktop Search.
> If this were my machine and I was bluescreening 4 times a day, I would consider uninstalling everything before I would did a reformat and reinstall.
Well, it's not quite that bad (4x daily) - although I did have 4 of them when trying to install that Outlook Update 933493 you referred me to as well as a subsequent run of Office Diagnostics. Before that, however I had gone 3 weeks without any BSODs.
> 1. Uninstall Google desktop and Windows Desktop Search if you have it installed.
> 2. Repost a Hijackthis log here.
I'm away from the PC with the problems today so tomorrow will be the earliest chance I'll have to try these two steps. Do I need to uninstall WDS or just stop it from starting automatically on boot?
> 3. Download and run both of these programs to test out your computer's memory.
http://oca.microsoft.com/en/windiag.asp and http://www.memtest.org/
these two seem to be pretty reliable. If I remember correctly, memtest86+ may take an overnight run.
Somewhere in my travels on this issue, I had previously run memtest86 for 7-8 hours (or was it "passes"?) and had no errors. I also had downloaded the windiag utility though I don't remember anything about the results of same ... if I had had any errors, I would have remembered but it's possible I didn't run it with everything else going on. I'll check that out, too, when I have the PC available again.
Jeff
Keep me posted.
I would uninstall a desktop search at this time. Just until we can rule it out.
I would uninstall a desktop search at this time. Just until we can rule it out.
ASKER
Ok, I just now uninstalled the Google Toolbars for both IE7 & Firefox 2.0 as well as Windows Desktop Search
I'll report back on whether this impacted the OL 2007 unexplained closing.
Jeff
I'll report back on whether this impacted the OL 2007 unexplained closing.
Jeff
Thanks, Let's also keep an eye on that Physical Memory and Current and Peak times.
From previous post, so you don't need to find it again.
"I believe you mentioned having Process Explorer, without rebooting, Could you open that once and click on View->System Information and give me the numbers you have listed for Physical Memory
Total
and the numbers you have for Commit Charge
Current -
Limit -
Peak - "
From previous post, so you don't need to find it again.
"I believe you mentioned having Process Explorer, without rebooting, Could you open that once and click on View->System Information and give me the numbers you have listed for Physical Memory
Total
and the numbers you have for Commit Charge
Current -
Limit -
Peak - "
ASKER
Ok, current numbers, as a baseline, are:
Total Physical Memory - 514,476
and the numbers you have for Commit Charge
Current - 899,420
Limit - 2,055,780
Peak - 907,284
I'll check those again whenever Outlook closes unexpectedly, if that's what you intended ...
Jeff
Total Physical Memory - 514,476
and the numbers you have for Commit Charge
Current - 899,420
Limit - 2,055,780
Peak - 907,284
I'll check those again whenever Outlook closes unexpectedly, if that's what you intended ...
Jeff
ASKER
I'll run the memtest86 overnight this evening. Here is current HJT log:
Logfile of HijackThis v1.99.1
Scan saved at 11:05:03 AM, on 5/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)
Running processes:
C:\WINDOWS\System32\smss.e
C:\WINDOWS\system32\winlog
C:\WINDOWS\system32\servic
C:\WINDOWS\system32\lsass.
C:\WINDOWS\system32\svchos
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchos
C:\WINDOWS\system32\spools
C:\WINDOWS\Explorer.EXE
C:\Acer\Empowering Technology\ePerformance\Me
C:\PROGRA~1\Grisoft\AVGFRE
F:\F_\Archived\Installed\S
C:\PROGRA~1\Grisoft\AVGFRE
C:\PROGRA~1\Grisoft\AVGFRE
C:\Acer\LANScope Agent\awServ.exe
C:\Program Files\Windows Defender\MSASCui.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.e
C:\PROGRA~1\Grisoft\AVGFRE
C:\WINDOWS\RTHDCPL.EXE
C:\Acer\Empowering Technology\eLock\LockServ.
C:\WINDOWS\system32\hkcmd.
C:\WINDOWS\system32\igfxpe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.e
C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
C:\Program Files\HyperSnap-DX 5\HprSnap5.exe
C:\Program Files\SpyCatcher\Protector
C:\Program Files\FreeWheel\FreeWheel.
C:\Program Files\SpyCatcher\Scheduler
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EX
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EX
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
C:\WINDOWS\system32\rundll
C:\WINDOWS\system32\mmc.ex
C:\Archived\HiJackThis\Hij
R1 - HKCU\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
R0 - HKCU\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: SpywareBlock Class - {0A87E45F-537A-40B4-B812-E
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-2
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-0
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-B
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-6
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-0
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-6
O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtr
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpe
O4 - HKLM\..\Run: [SpyCatcher Reminder] C:\Program Files\SpyCatcher\SpyCatche
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dump
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.e
O4 - Startup: FreeWheel.lnk = C:\Program Files\FreeWheel\FreeWheel.
O4 - Startup: Scheduler.lnk = C:\Program Files\SpyCatcher\Scheduler
O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
O4 - Global Startup: HyperSnap-DX 5.lnk = C:\Program Files\HyperSnap-DX 5\HprSnap5.exe
O4 - Global Startup: SpyCatcher Protector.lnk = C:\Program Files\SpyCatcher\Protector
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.h
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustom
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillFo
O8 - Extra context menu item: RoboForm Options - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComOption
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePa
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-0
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-0
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-0
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-0
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-0
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-0
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: http://download.windowsupdate.com
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-8
O16 - DPF: {17492023-C23A-453E-A040-C
O16 - DPF: {5ED80217-570B-4DA9-BF44-B
O16 - DPF: {6B75345B-AA36-438A-BBE6-4
O16 - DPF: {6E32070A-766D-4EE6-879C-D
O16 - DPF: {E8F628B5-259A-4734-97EE-B
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-0
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8
O20 - AppInit_DLLs: secuload.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxde
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLog
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-9
O23 - Service: Memory Check Service (AcerMemUsageCheckService)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE
O23 - Service: AdminWorks Agent X6 (AWService) - OSA Technologies Inc., An Avocent Company - C:\Acer\LANScope Agent\awServ.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.e
O23 - Service: LockServ - Unknown owner - C:\Acer\Empowering Technology\eLock\LockServ.
O23 - Service: ProgramCheckerPro (sassvc) - Unknown owner - C:\Program Files\ProgramChecker\sassv
Jeff
Logfile of HijackThis v1.99.1
Scan saved at 11:05:03 AM, on 5/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)
Running processes:
C:\WINDOWS\System32\smss.e
C:\WINDOWS\system32\winlog
C:\WINDOWS\system32\servic
C:\WINDOWS\system32\lsass.
C:\WINDOWS\system32\svchos
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchos
C:\WINDOWS\system32\spools
C:\WINDOWS\Explorer.EXE
C:\Acer\Empowering Technology\ePerformance\Me
C:\PROGRA~1\Grisoft\AVGFRE
F:\F_\Archived\Installed\S
C:\PROGRA~1\Grisoft\AVGFRE
C:\PROGRA~1\Grisoft\AVGFRE
C:\Acer\LANScope Agent\awServ.exe
C:\Program Files\Windows Defender\MSASCui.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.e
C:\PROGRA~1\Grisoft\AVGFRE
C:\WINDOWS\RTHDCPL.EXE
C:\Acer\Empowering Technology\eLock\LockServ.
C:\WINDOWS\system32\hkcmd.
C:\WINDOWS\system32\igfxpe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.e
C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
C:\Program Files\HyperSnap-DX 5\HprSnap5.exe
C:\Program Files\SpyCatcher\Protector
C:\Program Files\FreeWheel\FreeWheel.
C:\Program Files\SpyCatcher\Scheduler
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EX
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EX
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
C:\WINDOWS\system32\rundll
C:\WINDOWS\system32\mmc.ex
C:\Archived\HiJackThis\Hij
R1 - HKCU\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
R0 - HKCU\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: SpywareBlock Class - {0A87E45F-537A-40B4-B812-E
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-2
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-0
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-B
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-6
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-0
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-6
O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtr
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpe
O4 - HKLM\..\Run: [SpyCatcher Reminder] C:\Program Files\SpyCatcher\SpyCatche
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dump
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.e
O4 - Startup: FreeWheel.lnk = C:\Program Files\FreeWheel\FreeWheel.
O4 - Startup: Scheduler.lnk = C:\Program Files\SpyCatcher\Scheduler
O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
O4 - Global Startup: HyperSnap-DX 5.lnk = C:\Program Files\HyperSnap-DX 5\HprSnap5.exe
O4 - Global Startup: SpyCatcher Protector.lnk = C:\Program Files\SpyCatcher\Protector
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.h
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustom
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillFo
O8 - Extra context menu item: RoboForm Options - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComOption
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePa
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-0
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-0
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-0
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-0
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-0
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-0
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: http://download.windowsupdate.com
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-8
O16 - DPF: {17492023-C23A-453E-A040-C
O16 - DPF: {5ED80217-570B-4DA9-BF44-B
O16 - DPF: {6B75345B-AA36-438A-BBE6-4
O16 - DPF: {6E32070A-766D-4EE6-879C-D
O16 - DPF: {E8F628B5-259A-4734-97EE-B
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-0
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8
O20 - AppInit_DLLs: secuload.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxde
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLog
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-9
O23 - Service: Memory Check Service (AcerMemUsageCheckService)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE
O23 - Service: AdminWorks Agent X6 (AWService) - OSA Technologies Inc., An Avocent Company - C:\Acer\LANScope Agent\awServ.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.e
O23 - Service: LockServ - Unknown owner - C:\Acer\Empowering Technology\eLock\LockServ.
O23 - Service: ProgramCheckerPro (sassvc) - Unknown owner - C:\Program Files\ProgramChecker\sassv
Jeff
Yes.
Jeff, just so you know what I'm thinking. My thought is that you have too little RAM (which I believe you agree with, and I am aware can't upgrade at this point in time) so you are trying to push your Virtual memory too hard. My theory, I am trying to pinpoint. If I have read this thread correctly, you do not reboot too often thereby forcing high use of virtual memory.
Notes to myself for future.
http://support.microsoft.com/kb/555223
Memory, Pages Output/Sec - this shows how many virtual memory pages were written to the pagefile to free RAM page frames for other purposes each second.
This is the best counter to monitor if you suspect that paging is your performance bottleneck. Even if Committed Bytes is greater than the installed RAM, if Pages Output/sec is low or zero most of the time, there is not a significant performance problem from not enough RAM.
http://support.microsoft.com/kb/895932/en-us
Jeff, just so you know what I'm thinking. My thought is that you have too little RAM (which I believe you agree with, and I am aware can't upgrade at this point in time) so you are trying to push your Virtual memory too hard. My theory, I am trying to pinpoint. If I have read this thread correctly, you do not reboot too often thereby forcing high use of virtual memory.
Notes to myself for future.
http://support.microsoft.com/kb/555223
Memory, Pages Output/Sec - this shows how many virtual memory pages were written to the pagefile to free RAM page frames for other purposes each second.
This is the best counter to monitor if you suspect that paging is your performance bottleneck. Even if Committed Bytes is greater than the installed RAM, if Pages Output/sec is low or zero most of the time, there is not a significant performance problem from not enough RAM.
http://support.microsoft.com/kb/895932/en-us
Jeff, do you have one of the Office suites installed or simply Outlook 2007?
what version of the suite, if so?
what version of the suite, if so?
ASKER
I have Office 2007 and 2003 (Except for Outlook 2003 which was uninstalled as part of the 2007 install.
Not sure where you were going with the MS links above, but I did check the Performance Monitor reading for Memory, Pages Output/Sec which was "0" at the current time - this seemingly indicates lack of RAM may not be a significant performance issue ...
And for what it's worth, my "Memory usage" setting are set to adjust best usage for "Programs".
Jeff
Not sure where you were going with the MS links above, but I did check the Performance Monitor reading for Memory, Pages Output/Sec which was "0" at the current time - this seemingly indicates lack of RAM may not be a significant performance issue ...
And for what it's worth, my "Memory usage" setting are set to adjust best usage for "Programs".
Jeff
ASKER
Ok - Ran memtest86+ overnight for some 79 passes and WinDiag for about 4.5 hours (11+ passes). Both found no errors.
In terms of Virtual Memory usage in my current session that's 4.5 hours old, I have Session Peak Usage values of 250 MB (out of 256 MB) on my C: drive, and 212 MB (out of 1280 MB) on my G: drive. Again, FWIW, an OEM (Acer) memory Utility indicates "You do not need to upgrade memory" even though I've always run quite a few applications simultaneously.
Jeff
In terms of Virtual Memory usage in my current session that's 4.5 hours old, I have Session Peak Usage values of 250 MB (out of 256 MB) on my C: drive, and 212 MB (out of 1280 MB) on my G: drive. Again, FWIW, an OEM (Acer) memory Utility indicates "You do not need to upgrade memory" even though I've always run quite a few applications simultaneously.
Jeff
Jeff,
I know you don't think this is a big deal, (values of 250 MB (out of 256 MB) on my C: drive, ) because you have G: also, but that sure bugs me. There is something there, nagging me. And I do understand you always run quite a few applications simultaneously.
Do me a favor, sometime when you have some time or simply want to reboot, do it.
Before you let anything like Outlook or Firefox or Office open, hit the Task Manager and see how quickly your 512 MB of RAM is used.
If you are sure your G: drive seems up to the task again, why not move all of your Virtual Memory to it and see how it goes for a little while?
How much free space do you have on your C: Drive?
I know you don't think this is a big deal, (values of 250 MB (out of 256 MB) on my C: drive, ) because you have G: also, but that sure bugs me. There is something there, nagging me. And I do understand you always run quite a few applications simultaneously.
Do me a favor, sometime when you have some time or simply want to reboot, do it.
Before you let anything like Outlook or Firefox or Office open, hit the Task Manager and see how quickly your 512 MB of RAM is used.
If you are sure your G: drive seems up to the task again, why not move all of your Virtual Memory to it and see how it goes for a little while?
How much free space do you have on your C: Drive?
ASKER
Well, I set up my Virtual Memory according to the advice from Alex Nichol at:
http://aumha.org/win5/a/xpvm.php
... who says there:
"Should the file be left on Drive C:?
The slowest aspect of getting at a file on a hard disk is in head movement (‘seeking’). If you have only one physical drive then the file is best left where the heads are most likely to be, so where most activity is going on — on drive C:. If you have a second physical drive, it is in principle better to put the file there, because it is then less likely that the heads will have moved away from it. If, though, you have a modern large size of RAM, actual traffic on the file is likely to be low, even if programs are rolled out to it, inactive, so the point becomes an academic one. If you do put the file elsewhere, you should leave a small amount on C: — an initial size of 2MB with a Maximum of 50 is suitable — so it can be used in emergency. Without this, the system is inclined to ignore the settings and either have no page file at all (and complain) or make a very large one indeed on C:
In relocating the page file, it must be on a ‘basic’ drive. Windows XP appears not to be willing to accept page files on ‘dynamic’ drives.
NOTE: If you are debugging crashes and wish the error reporting to make a kernel or full dump, then you will need an initial size set on C: of either 200 MB (for a kernel dump) or the size of RAM (for a full memory dump). If you are not doing so, it is best to make the setting to no more than a ‘Small Dump’, at Control Panel | System | Advanced, click Settings in the ‘Startup and Recovery’ section, and select in the ‘Write Debug information to’ panel."
He also had this to say about "free RAM:
"Windows will always try to find some use for all of RAM — even a trivial one. If nothing else it will retain code of programs in RAM after they exit, in case they are needed again. Anything left over will be used to cache further files — just in case they are needed. But these uses will be dropped instantly should some other use come along. Thus there should rarely be any significant amount of RAM ‘free’. That term is a misnomer — it ought to be ‘RAM for which Windows can currently find no possible use’. The adage is: ‘Free RAM is wasted RAM’."
I also was influenced here by Daniel Petri's page at: http://www.petri.co.il/pagefile_optimization.htm
Jeff
http://aumha.org/win5/a/xpvm.php
... who says there:
"Should the file be left on Drive C:?
The slowest aspect of getting at a file on a hard disk is in head movement (‘seeking’). If you have only one physical drive then the file is best left where the heads are most likely to be, so where most activity is going on — on drive C:. If you have a second physical drive, it is in principle better to put the file there, because it is then less likely that the heads will have moved away from it. If, though, you have a modern large size of RAM, actual traffic on the file is likely to be low, even if programs are rolled out to it, inactive, so the point becomes an academic one. If you do put the file elsewhere, you should leave a small amount on C: — an initial size of 2MB with a Maximum of 50 is suitable — so it can be used in emergency. Without this, the system is inclined to ignore the settings and either have no page file at all (and complain) or make a very large one indeed on C:
In relocating the page file, it must be on a ‘basic’ drive. Windows XP appears not to be willing to accept page files on ‘dynamic’ drives.
NOTE: If you are debugging crashes and wish the error reporting to make a kernel or full dump, then you will need an initial size set on C: of either 200 MB (for a kernel dump) or the size of RAM (for a full memory dump). If you are not doing so, it is best to make the setting to no more than a ‘Small Dump’, at Control Panel | System | Advanced, click Settings in the ‘Startup and Recovery’ section, and select in the ‘Write Debug information to’ panel."
He also had this to say about "free RAM:
"Windows will always try to find some use for all of RAM — even a trivial one. If nothing else it will retain code of programs in RAM after they exit, in case they are needed again. Anything left over will be used to cache further files — just in case they are needed. But these uses will be dropped instantly should some other use come along. Thus there should rarely be any significant amount of RAM ‘free’. That term is a misnomer — it ought to be ‘RAM for which Windows can currently find no possible use’. The adage is: ‘Free RAM is wasted RAM’."
I also was influenced here by Daniel Petri's page at: http://www.petri.co.il/pagefile_optimization.htm
Jeff
Thanks Jeff,
I've seen those pages before. Unfortunately, I can't read or decipher the Dumps you might be getting. So I don't think I will be much more help.
The last thing I think I would recommend is to get in the habit of rebooting maybe starting with once every three days and if you keep crashing before that , move it up to once every 2 days until you see a spot where you don't crash anymore.
I might also recommend
Superantispyware http://www.superantispyware.com/.
and maybe checking out AVG free antispyware. http://free.grisoft.com/doc/20/lng/us/tpl/v5
just to have a couple more to check out your system with. I'm not crazy about that secuload.dll
The only reference to it on the web seems to be Hijackthis logs.
I've seen those pages before. Unfortunately, I can't read or decipher the Dumps you might be getting. So I don't think I will be much more help.
The last thing I think I would recommend is to get in the habit of rebooting maybe starting with once every three days and if you keep crashing before that , move it up to once every 2 days until you see a spot where you don't crash anymore.
I might also recommend
Superantispyware http://www.superantispyware.com/.
and maybe checking out AVG free antispyware. http://free.grisoft.com/doc/20/lng/us/tpl/v5
just to have a couple more to check out your system with. I'm not crazy about that secuload.dll
The only reference to it on the web seems to be Hijackthis logs.
ASKER
Well, thanks for all the help you've tried to provide ... I was literally about to say I hadn't seen the OL closing without notice problem in several days when it happened again ... so I guess the cause is not those things I've uninstalled or turned off.
I don't know what to make of the secuload.dll file, either ... Google only had 7 hits for it, and as you said, they were all HiJackThis or similar logs. What was more surprising to me is that ALL 7 of these hits were posted within the last week ... whatever it is, it hasn't been around long apparently ...
Well, I guess the only thing left to do here is to either re-install Office 2007 and/or Windows XP ... With respect to the latter, I created a slipstreamed CD with WinXP & SP2, burned it with an ISO .img file using Nero - but for some reason, neither of my PC's will not boot with it ... Although, if they are already booted, and then I insert the CD, it is then recognized as a Windows XP install disk ... Anyway, after reading the following article, I believe I can still use the "Method 1" ("Reinstall Windows XP by using Windows XP" with XP already booted) even though I can't boot with it.
"How to perform an in-place upgrade (reinstallation) of Windows XP"
http://support.microsoft.com/default.aspx?scid=kb;en-us;315341
However, I also came across this article:
"How Do I Install Windows XP On A SATA Hard Drive"
http://xphelpandsupport.mvps.org/how_do_i_install_windows_xp_on_a.htm
... which indicates that Windows XP doesn’t contain the necessary drivers to allow windows to see the drive so that Windows can install it. I've contacted my OEM (Acer) who advised:
"Acer does not provide these drivers separately nor do we support the creation of the (slipstream) disc you mention. The unit comes with a utility called eRecovery that will completely reinstall the OEM software including all factory provided drivers and applications. It also prompts you to create a copy of the installation discs so that in the event you replace the hard drive, you can still install the OEM software."
Unfortunately, eRecovery is not installed on my PC and I was not given a disk by the computer store where I bought the PC (since I have a retail copy of Windows XP Upgrade, I didn't think it would be an issue, but that was before I knew about the SATA drivers issue). Anyway, I've asked the OEM for a copy of this eRecovery utility but probably won't see that for a while, if ever. In the meantime, would you expect I would have any problem doing an in-place repair of XP under these circumstances?
Jeff
I don't know what to make of the secuload.dll file, either ... Google only had 7 hits for it, and as you said, they were all HiJackThis or similar logs. What was more surprising to me is that ALL 7 of these hits were posted within the last week ... whatever it is, it hasn't been around long apparently ...
Well, I guess the only thing left to do here is to either re-install Office 2007 and/or Windows XP ... With respect to the latter, I created a slipstreamed CD with WinXP & SP2, burned it with an ISO .img file using Nero - but for some reason, neither of my PC's will not boot with it ... Although, if they are already booted, and then I insert the CD, it is then recognized as a Windows XP install disk ... Anyway, after reading the following article, I believe I can still use the "Method 1" ("Reinstall Windows XP by using Windows XP" with XP already booted) even though I can't boot with it.
"How to perform an in-place upgrade (reinstallation) of Windows XP"
http://support.microsoft.com/default.aspx?scid=kb;en-us;315341
However, I also came across this article:
"How Do I Install Windows XP On A SATA Hard Drive"
http://xphelpandsupport.mvps.org/how_do_i_install_windows_xp_on_a.htm
... which indicates that Windows XP doesn’t contain the necessary drivers to allow windows to see the drive so that Windows can install it. I've contacted my OEM (Acer) who advised:
"Acer does not provide these drivers separately nor do we support the creation of the (slipstream) disc you mention. The unit comes with a utility called eRecovery that will completely reinstall the OEM software including all factory provided drivers and applications. It also prompts you to create a copy of the installation discs so that in the event you replace the hard drive, you can still install the OEM software."
Unfortunately, eRecovery is not installed on my PC and I was not given a disk by the computer store where I bought the PC (since I have a retail copy of Windows XP Upgrade, I didn't think it would be an issue, but that was before I knew about the SATA drivers issue). Anyway, I've asked the OEM for a copy of this eRecovery utility but probably won't see that for a while, if ever. In the meantime, would you expect I would have any problem doing an in-place repair of XP under these circumstances?
Jeff
ASKER
Re: Your earlier comments:
> Do me a favor, sometime when you have some time or simply want to reboot, do it.
> Before you let anything like Outlook or Firefox or Office open, hit the Task Manager and see how > quickly your 512 MB of RAM is used.
I'm not sure what you meant by "how quickly" the RAM was used, but if you meant was what were my Commit charges with only a minimal load (without FF, OL or Office open), these are the Commit charges stats with just Process Explorer and a couple of Windows Explorer sessions open:
Current: 310,900
Limit: 2,055,780
Peak: 314,920
> How much free space do you have on your C: Drive?
I have 41 GB free on the C: drive.
Jeff
> Do me a favor, sometime when you have some time or simply want to reboot, do it.
> Before you let anything like Outlook or Firefox or Office open, hit the Task Manager and see how > quickly your 512 MB of RAM is used.
I'm not sure what you meant by "how quickly" the RAM was used, but if you meant was what were my Commit charges with only a minimal load (without FF, OL or Office open), these are the Commit charges stats with just Process Explorer and a couple of Windows Explorer sessions open:
Current: 310,900
Limit: 2,055,780
Peak: 314,920
> How much free space do you have on your C: Drive?
I have 41 GB free on the C: drive.
Jeff
5/11
Ok, current numbers, as a baseline, are:
Total Physical Memory - 514,476
and the numbers you have for Commit Charge
Current - 899,420
Limit - 2,055,780
Peak - 907,284
5/17
Current: 310,900
Limit: 2,055,780
Peak: 314,920
I know Outlook requires minimum of 512 MB anyways.
As far as a repair/reinstall I do not know if that is possible with an upgrade disk off the top of my head. Also you might be able to find the SATA drivers from your Motherboard's website. Keep in mind Erecovery probably will only reinstall the original hard drive to it's state at time of purchase. But I have never used Acer's program. The installation discs you referenced from Acer more than likely will do the same. Maybe a little google for the upgrade repair/reinstall
ASKER
Well, I guess it's time to close this saga out. While I still haven't found the cause of OL closing unexpectedly, the frequency has dropped as has the number of BSODs I had been seeing (neither has occurred in the last 6 days ...).
I can't fault your efforts, though, in trying to help my find a solution (especially with a new Release such as OL 2007) so I will award points for the efforts expended.
Thanks again, mtz1of4 !
Jeff
I can't fault your efforts, though, in trying to help my find a solution (especially with a new Release such as OL 2007) so I will award points for the efforts expended.
Thanks again, mtz1of4 !
Jeff
I'm going to start with the most obvious.
First, make sure IE is your default browser.
Second, and the most common cause of OL 2007 crashing is old addins.
Disable them and test.
You can start Outlook in safe mode to temporarly remove them.
Click the Start button and select run.
Type in Outlook.exe /safe
Or, remove them from the addin manager located in Tools ~ Trust Center ~ Add-Ins
cheers,
frankco