Rodgibbo1
asked on
BSOD "page fault in nonpaged area" 0x00000050
BSOD "page fault in nonpaged area" on a Toshiba G30 laptop with 1G ram. XP SP2. Event viewer says "The computer has rebooted from a bugcheck. The bugcheck was: 0x00000050 (0xb6a26070, 0x00000001, 0x804da12e, 0x00000000). A dump was saved in: C:\WINDOWS\MEMORY.DMP." Can't get any further than safe mode. No new hardware / software etc. Please help asap.
ASKER
Event viewer says "The computer has rebooted from a bugcheck. The bugcheck was: 0x00000050 (0xb6a26070, 0x00000001, 0x804da12e, 0x00000000). A dump was saved in: C:\WINDOWS\MEMORY.DMP."
have a look in this : http://www.techspot.com/vb/all/windows/t-19636-Page-fault-in-nonpaged-area.html
Take a look in the red line and try the solution:
http://support.microsoft.com/?kbid=894278&sd=RMVP
Hope this help ....
http://support.microsoft.com/?kbid=894278&sd=RMVP
Hope this help ....
ASKER
Yeah have tried all these - still no joy. There were no malicious drivers detected.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
If you can't boot at all, try to press F8 at the startup and go into safe mode command prompt only. This will let you run the chkdsk /r
ASKER
Havent tried that yet. Thanks. Will keep you posted.
ASKER
Ran CHKDSK in safe mode. rebooted and got same BSOD with same error - 0x00000050 (0xb6a26070, 0x00000001, 0x804da12e, 0x00000000)
Hi,
If you have access to another pc to download a file.
Try running this tool in safe mode.
Download SDFix and save it to your desktop.
http://downloads.andymanchesta.com/RemovalTools/SDFix.zip
Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)
Please then reboot your computer in Safe Mode by doing the following :
* Restart your computer
* After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
* Instead of Windows loading as normal, a menu with options should appear;
* Select the first option, to run Windows in Safe Mode, then press "Enter".
* Choose your usual account.
* Open the extracted folder and double click "RunThis.bat" to start the script.
* Type "Y" to begin the script.
* It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot.
* Press any Key and it will restart the PC.
* Your system will take longer that normal to restart as the fixtool will be running and removing files.
* When the desktop loads the Fixtool will complete the removal and display "Finished", then press any key to end the script and load your desktop icons.
* Finally open the SDFix folder on your desktop and copy and paste the contents of the results file "Report.txt" back
Or, this one maybe, or a Hijackthis log
Download ComboFix to your Desktop, from either of these locations:
http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Double click "combofix.exe" and follow the prompts.
When finished, it shall produce a log for you.
Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall
If you have access to another pc to download a file.
Try running this tool in safe mode.
Download SDFix and save it to your desktop.
http://downloads.andymanchesta.com/RemovalTools/SDFix.zip
Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)
Please then reboot your computer in Safe Mode by doing the following :
* Restart your computer
* After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
* Instead of Windows loading as normal, a menu with options should appear;
* Select the first option, to run Windows in Safe Mode, then press "Enter".
* Choose your usual account.
* Open the extracted folder and double click "RunThis.bat" to start the script.
* Type "Y" to begin the script.
* It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot.
* Press any Key and it will restart the PC.
* Your system will take longer that normal to restart as the fixtool will be running and removing files.
* When the desktop loads the Fixtool will complete the removal and display "Finished", then press any key to end the script and load your desktop icons.
* Finally open the SDFix folder on your desktop and copy and paste the contents of the results file "Report.txt" back
Or, this one maybe, or a Hijackthis log
Download ComboFix to your Desktop, from either of these locations:
http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Double click "combofix.exe" and follow the prompts.
When finished, it shall produce a log for you.
Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall
ASKER
OK gamergirl. 3.30am pacific time though. Will sleep on it and get back to you.
Sometimes the error you describe is related to the swap file (page file). One possible test as part of the troubleshooting, is to remove the swap file and then re-create one, using a (not too big) fixed size for it. That will probably cause it to use other parts of disk surface and it may help. A thorough hard drive test, as suggested already, is of course of the essence. Chkdsk is not the right tool for this; AFAIK. It checks the file system but not the surface, I think.
/RID
/RID
ASKER
Can i do a harddrive test in safe mode ?
If so, whats the best online harddrive test i can get (are there any good ones that are free)
If so, whats the best online harddrive test i can get (are there any good ones that are free)
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
http://www.hitachigst.com/hdd/support/download.htm Drive Fitness Test
http://www.maxtor.com/en/support/products/index.htm Maxtor & Quantum
http://www.fcpa.fujitsu.com/support/hard-drives/software_utilities.html#diagnostic Fujitsu
http://www.samsung.com/Products/HardDiskDrive/utilities/shdiag.htm Samsung
http://www.seagate.com/support/seatools/index.html Seagate
http://support.wdc.com/download/#diagutils Western Digital
http://www.hgst.com/hdd/support/download.htm IBM & Hitachi DFT
You can have a try for that software provided by the manufacturer (base on your HD manufacturer) .... hope that help ...... And make sure you backup those important files before you test it out.
http://www.maxtor.com/en/support/products/index.htm Maxtor & Quantum
http://www.fcpa.fujitsu.com/support/hard-drives/software_utilities.html#diagnostic Fujitsu
http://www.samsung.com/Products/HardDiskDrive/utilities/shdiag.htm Samsung
http://www.seagate.com/support/seatools/index.html Seagate
http://support.wdc.com/download/#diagutils Western Digital
http://www.hgst.com/hdd/support/download.htm IBM & Hitachi DFT
You can have a try for that software provided by the manufacturer (base on your HD manufacturer) .... hope that help ...... And make sure you backup those important files before you test it out.
ASKER
Yo gamergirl,
Here's the report txt from SDFix:
SDFix: Version 1.95
Run by Rod on Mon 06/08/2007 at 03:38 p.m.
Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix
Safe Mode:
Checking Services:
Restoring Windows Registry Values
Restoring Windows Default Hosts File
Here's the report txt from SDFix:
SDFix: Version 1.95
Run by Rod on Mon 06/08/2007 at 03:38 p.m.
Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix
Safe Mode:
Checking Services:
Restoring Windows Registry Values
Restoring Windows Default Hosts File
Is that all? that doesn't seem right, even if it didn't find anything that report is awfully short and looks incomplete, :)
You've ruled-out hardware/software or driver issues?
Can you try and run another tool?
Download ComboFix to your Desktop, from either of these locations:
http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Double click "combofix.exe" and follow the prompts.
When finished, it shall produce a log for you.
Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall
You've ruled-out hardware/software or driver issues?
Can you try and run another tool?
Download ComboFix to your Desktop, from either of these locations:
http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Double click "combofix.exe" and follow the prompts.
When finished, it shall produce a log for you.
Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall
ASKER
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:18:27 a.m., on 7/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode with network support
Running processes:
C:\WINDOWS\System32\smss.e xe
C:\WINDOWS\system32\winlog on.exe
C:\WINDOWS\system32\servic es.exe
C:\WINDOWS\system32\lsass. exe
C:\WINDOWS\system32\svchos t.exe
C:\WINDOWS\system32\svchos t.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EX E
C:\WINDOWS\system32\ctfmon .exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EX E
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepa d.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThi s.exe
R0 - HKCU\Software\Microsoft\In ternet Explorer\Main,Start Page = http://www.google.co.nz/
R0 - HKLM\Software\Microsoft\In ternet Explorer\Main,Start Page = about:blank
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-7 84B7D6BE0B 3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.d ll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-0 0123456789 0} - C:\WINDOWS\System32\DLA\DL ASHX_W.DLL
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-2 98DDF1699E 1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt .dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-7 31BB6995FD D} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-C F10577473F 7} - c:\program files\google\googletoolbar 2.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A 37C9A5676A 7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt .dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-2 0066696354 B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-0 09027A5CD4 F} - c:\program files\google\googletoolbar 2.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.ex e
O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\system32\00THot key.exe
O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe
O4 - HKLM\..\Run: [TFNF5] TFNF5.exe
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
O4 - HKLM\..\Run: [TouchED] C:\Program Files\TOSHIBA\TouchED\Touc hED.Exe
O4 - HKLM\..\Run: [TosHKCW.exe] "C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe"
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [TPSODDCtl] TPSODDCtl.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [Kraidman] C:\Program Files\TOSHIBA\TOSHIBA RAID\Console\Kraidman.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DL ACTRLW.EXE
O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Protector Suite QL\launcher.exe" /startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl. dll,NvStar tup
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynT PEnh.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\Z CfgSvc.exe "
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\i frmewrk.ex e" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCh eck.exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobs ync.exe /logon
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\reals ched.exe" -osboot
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\ opware32.e xe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582- 4c61-B58F- 2F227FCA9A 08}\PIFSvc .exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582- 4c61-B58F- 2F227FCA9A 08}\AlertE ng.dll"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe " -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper. exe"
O4 - HKLM\..\Run: [SDFix] C:\SDFix\RunThis.bat /second
O4 - HKLM\..\RunOnce: [SDFix] C:\SDFix\RunThis.bat /second
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\tos cdspd.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe " /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.ex e" /nosplash /minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbar Notifier\1 .2.908.500 8\GoogleTo olbarNotif ier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon .exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Ad obe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASS T.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2 \OFFICE11\ EXCEL.EXE/ 3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-0 0401C60850 1} - C:\Program Files\Java\jre1.5.0_04\bin \npjpi150_ 04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-0 0401C60850 1} - C:\Program Files\Java\jre1.5.0_04\bin \npjpi150_ 04.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3 C9C571A826 3} - C:\PROGRA~1\MICROS~2\OFFIC E11\REFIEB AR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f 2ba3849658 3} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f 2ba3849658 3} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-0 0C04F79568 3} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-0 0C04F79568 3} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)
O16 - DPF: {6E32070A-766D-4EE6-879C-D C1FA91D2FC 3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1148279489703
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDev iceService .exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ ALUSchedul erSvc.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcg en.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\C FSvcs.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAM SV.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\E vtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver \11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService .exe
O23 - Service: TOSHIBA RAID Service (kraidsvc) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TOSHIBA RAID\Service\kraidsvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEU P~1\LUCOMS ~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582- 4c61-B58F- 2F227FCA9A 08}\PIFSvc .exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc3 2.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\R egSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S 24EvMon.ex e
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\stacsv.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServi ce.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.ex e
combofix
ComboFix 07-08-04.3 - "Rod" 2007-08-07 8:04:35.1 [GMT 12:00] - NTFS [SAFE MODE]
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18. True
((((((((((((((((((((((((( Files Created from 2007-07-06 to 2007-08-06 )))))))))))))))))))))))))) )))))
2007-08-07 08:04 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-08-06 15:20 <DIR> d-------- C:\WINDOWS\ERUNT
2007-08-03 08:08 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLI C~1\Apple
2007-08-03 08:06 <DIR> d-------- C:\Program Files\VideoCAM Eye
2007-08-03 08:06 <DIR> d-------- C:\Program Files\Common Files\VCAMEye
2007-08-03 08:04 <DIR> d-------- C:\Program Files\Common Files\DirectX
2007-08-02 14:18 <DIR> d--hs---- C:\WINDOWS\CSC
2007-08-01 17:00 7,077,888 --a------ C:\DOCUME~1\Rod\ntuser.dat
2007-07-31 15:15 <DIR> d-------- C:\Program Files\iTunes
2007-07-31 15:13 <DIR> d-------- C:\Program Files\Common Files\Apple
2007-07-31 15:07 <DIR> d-------- C:\Program Files\QuickTime
2007-07-12 22:08 98,304 --a------ C:\WINDOWS\system32\rsnpst d.dll
2007-07-12 22:08 61,440 --a------ C:\WINDOWS\system32\csnpst d.dll
2007-07-12 22:08 53,248 --a------ C:\WINDOWS\system32\dsnpst d.dll
2007-07-12 22:08 390,912 --a------ C:\WINDOWS\system32\driver s\snpstd.s ys
2007-07-12 22:08 36,864 --a------ C:\WINDOWS\system32\vsnpst d.dll
2007-07-12 22:08 286,720 --a------ C:\WINDOWS\vsnpstd.exe
2007-07-12 22:08 <DIR> d-------- C:\WINDOWS\Album
2007-07-08 03:09 1,100 --a------ C:\WINDOWS\system32\d3d8ca ps.dat
(((((((((((((((((((((((((( (((((((((( (((( Find3M Report )))))))))))))))))))))))))) )))))))))) )))))))))) ))))))
2007-08-07 00:14 --------- d-------- C:\DOCUME~1\Rod\SendTo\APP LIC~1\Skyp e
2007-08-04 00:27 --------- d-------- C:\Program Files\e-Sword
2007-08-03 08:06 --------- d-------- C:\Program Files\Common Files\Symantec Shared
2007-07-31 19:33 --------- d-------- C:\DOCUME~1\Rod\SendTo\APP LIC~1\Appl e Computer
2007-07-31 15:15 --------- d-------- C:\Program Files\iPod
2007-07-26 20:20 --------- d-------- C:\DOCUME~1\Rod\SendTo\APP LIC~1\Cano n
2007-07-17 11:13 --------- d-------- C:\Program Files\Norton Internet Security
2007-07-13 11:13 43520 --a------ C:\WINDOWS\system32\CmdLin eExt03.dll
2007-07-12 22:08 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-07-05 15:41 --------- d-------- C:\Program Files\EA GAMES
2007-06-18 00:40 4581246 --a------ C:\WINDOWS\Screensaver-Sli deshow.scr
2007-06-17 14:36 --------- d-------- C:\Program Files\Smart PDF Converter
2007-06-16 15:20 --------- d-------- C:\DOCUME~1\Rod\SendTo\APP LIC~1\Soli dDocuments
2007-06-16 14:05 --------- d-------- C:\Program Files\SolidDocuments
2007-06-16 01:08 --------- d-------- C:\Program Files\VeryPDF PDF2Word v3.0
2007-06-13 11:36 --------- d-------- C:\Program Files\FLVPlayer
2007-06-13 11:30 --------- d-------- C:\Program Files\FLV Player
2007-05-17 03:12 86528 -----c--- C:\WINDOWS\system32\dllcac he\directd b.dll
2007-05-17 03:12 85504 -----c--- C:\WINDOWS\system32\dllcac he\wabimp. dll
2007-05-17 03:12 683520 --a------ C:\WINDOWS\system32\inetco mm.dll
2007-05-17 03:12 683520 -----c--- C:\WINDOWS\system32\dllcac he\inetcom m.dll
2007-05-17 03:12 510976 -----c--- C:\WINDOWS\system32\dllcac he\wab32.d ll
2007-05-17 03:12 1314816 -----c--- C:\WINDOWS\system32\dllcac he\msoe.dl l
2006-08-02 14:25 2327233 --a------ C:\Program Files\audacity-win-1.2.4b. exe
2006-05-26 20:22 45511810 --a------ C:\Program Files\NIS06910AP_2YR.exe
2006-05-12 00:01 2719485 --a------ C:\Program Files\amp.exe
2003-07-25 11:38 132096 --a------ C:\Program Files\Common Files\PCSBoff.exe
(((((((((((((((((((((((((( (((((((((( ( Reg Loading Points )))))))))))))))))))))))))) )))))))))) )))))))))) ))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWA RE\Microso ft\Windows \CurrentVe rsion\Run]
"ehTray"="C:\WINDOWS\ehome \ehtray.ex e" [2005-08-06 09:56]
"00THotkey"="C:\WINDOWS\sy stem32\00T Hotkey.exe " [2005-03-01 20:43]
"000StTHK"="000StTHK.exe" [2001-06-24 00:28 C:\WINDOWS\system32\000StT HK.exe]
"TFNF5"="TFNF5.exe" [2005-12-09 13:36 C:\WINDOWS\system32\TFNF5. exe]
"SmoothView"="C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2005-04-27 12:13]
"TouchED"="C:\Program Files\TOSHIBA\TouchED\Touc hED.Exe" [2005-06-29 16:43]
"TosHKCW.exe"="C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe" [2005-05-18 07:42]
"NDSTray.exe"="NDSTray.exe " []
"TPSMain"="TPSMain.exe" [2005-12-06 20:25 C:\WINDOWS\system32\TPSMai n.exe]
"TPSODDCtl"="TPSODDCtl.exe " [2005-12-06 20:25 C:\WINDOWS\system32\TPSODD Ctl.exe]
"TFncKy"="TFncKy.exe" []
"Kraidman"="C:\Program Files\TOSHIBA\TOSHIBA RAID\Console\Kraidman.exe" [2005-10-01 05:47]
"DLA"="C:\WINDOWS\System32 \DLA\DLACT RLW.EXE" [2005-10-07 01:20]
"PSQLLauncher"="C:\Program Files\Protector Suite QL\launcher.exe" [2005-12-22 17:29]
"NvCplDaemon"="C:\WINDOWS\ system32\N vCpl.dll" [2006-01-09 20:18]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynT PEnh.exe" [2005-12-09 05:58]
"IntelZeroConfig"="C:\Prog ram Files\Intel\Wireless\bin\Z CfgSvc.exe " [2005-12-05 12:37]
"IntelWireless"="C:\Progra m Files\Intel\Wireless\Bin\i frmewrk.ex e" [2005-11-28 11:41]
"NeroFilterCheck"="C:\WIND OWS\system 32\NeroChe ck.exe" [2001-07-09 10:50]
"Synchronization Manager"="C:\WINDOWS\syste m32\mobsyn c.exe" [2004-08-10 08:00]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-22 22:19]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\reals ched.exe" [2006-05-27 14:55]
"Omnipage"="C:\Program Files\ScanSoft\OmniPageSE\ opware32.e xe" [2002-06-03 11:38]
"AGRSMMSG"="AGRSMMSG.exe" [2005-10-15 06:29 C:\WINDOWS\agrsmmsg.exe]
"SigmatelSysTrayApp"="stsy stra.exe" []
"McDiags AutoLaunch"="" []
"snpstd"="C:\WINDOWS\vsnps td.exe" [2004-06-10 13:48]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582- 4c61-B58F- 2F227FCA9A 08}\PIFSvc .exe" [2007-03-12 18:30]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe " [2007-06-29 06:24]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper. exe" [2007-07-10 09:18]
"SDFix"="C:\SDFix\RunThis. bat /second" []
[HKEY_CURRENT_USER\SOFTWAR E\Microsof t\Windows\ CurrentVer sion\Run]
"TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\tos cdspd.exe" [2004-12-30 20:32]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe " [2004-10-14 04:24]
"Skype"="C:\Program Files\Skype\Phone\Skype.ex e" [2006-11-24 16:16]
"swg"="C:\Program Files\Google\GoogleToolbar Notifier\1 .2.908.500 8\GoogleTo olbarNotif ier.exe" [2006-11-23 09:11]
"ctfmon.exe"="C:\WINDOWS\s ystem32\ct fmon.exe" [2004-08-10 08:00]
[HKEY_LOCAL_MACHINE\softwa re\microso ft\windows \currentve rsion\runo nce]
"SDFix"=C:\SDFix\RunThis.b at /second
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Ad obe Gamma Loader.exe [2006-05-23 00:16:56]
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2005-12-08 10:01:32]
RAMASST.lnk - C:\WINDOWS\system32\RAMASS T.exe [2005-12-20 11:35:18]
[HKEY_LOCAL_MACHINE\softwa re\microso ft\windows \currentve rsion\poli cies\syste m]
"InstallVisualStyle"=C:\WI NDOWS\Reso urces\Them es\Royale\ Royale.mss tyles
"InstallTheme"=C:\WINDOWS\ Resources\ Themes\Roy ale.theme
[HKEY_LOCAL_MACHINE\softwa re\microso ft\windows nt\currentversion\winlogon \notify\ps fus]
psqlpwd.dll 2005-12-22 17:42 40448 C:\WINDOWS\system32\psqlpw d.dll
[HKEY_LOCAL_MACHINE\system \currentco ntrolset\c ontrol\lsa ]
"Notification Packages"= scecli psqlpwd
R0 KR10N;KR10N;C:\WINDOWS\sys tem32\driv ers\KR10N. sys
R0 prohlp02;StarForce Protection Helper Driver v2;C:\WINDOWS\system32\dri vers\prohl p02.sys
R0 prosync1;StarForce Protection Synchronization Driver v1;C:\WINDOWS\system32\dri vers\prosy nc1.sys
R0 sfhlp01;StarForce Protection Helper Driver;C:\WINDOWS\system32 \drivers\s fhlp01.sys
R0 TVALZ;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Driver;C:\WINDOWS\system32 \DRIVERS\T VALZ.SYS
R0 Vax347b;Vax347b;C:\WINDOWS \system32\ DRIVERS\Va x347b.sys
R0 Vax347s;Vax347s;C:\WINDOWS \system32\ Drivers\Va x347s.sys
R1 meiudf;meiudf;C:\WINDOWS\s ystem32\Dr ivers\meiu df.sys
R3 e1express;Intel(R) PRO/1000 PCI Express Network Connection Driver;C:\WINDOWS\system32 \DRIVERS\e 1e5132.sys
R3 Iviaspi;IVI ASPI Shell;C:\WINDOWS\system32\ drivers\iv iaspi.sys
R3 SynTP;Synaptics TouchPad Driver;C:\WINDOWS\system32 \DRIVERS\S ynTP.sys
R3 tosrfec;Bluetooth ACPI from TOSHIBA;C:\WINDOWS\system3 2\DRIVERS\ tosrfec.sy s
R3 w39n51;Intel(R) PRO/Wireless 3945ABG Adapter Driver;C:\WINDOWS\system32 \DRIVERS\w 39n51.sys
S1 prodrv06;StarForce Protection Environment Driver v6;C:\WINDOWS\system32\dri vers\prodr v06.sys
S1 Tosrfcom;Bluetooth RFCOMM from TOSHIBA;C:\WINDOWS\system3 2\Drivers\ tosrfcom.s ys
S2 FdRedir;FdRedir;\??\C:\Pro gram Files\Common Files\Protector Suite QL\Drivers\FdRedir.sys
S2 FileDisk2;FileDisk Protector Kernel Driver;\??\C:\Program Files\Common Files\Protector Suite QL\Drivers\filedisk.sys
S2 Netdevio;TOSHIBA Network Device Usermode I/O Protocol;C:\WINDOWS\system 32\DRIVERS \netdevio. sys
S2 s24trans;WLAN Transport;C:\WINDOWS\syste m32\DRIVER S\s24trans .sys
S2 smihlp;SMI helper driver;\??\C:\Program Files\Protector Suite QL\smihlp.sys
S2 TOS_SPS;TOSHIBA SPS Driver;\??\C:\Program Files\TOSHIBA\TMP2VDec\TOS _SPS.sys
S3 CE3;Xircom Ethernet Adapter 10/100 Service;C:\WINDOWS\system3 2\DRIVERS\ ce3n5.sys
S3 E100B;Intel(R) PRO Network Connection Driver;C:\WINDOWS\system32 \DRIVERS\e 100b325.sy s
S3 lredbooo;lredbooo;\??\C:\D OCUME~1\Ro d\LOCALS~1 \Temp\lred booo.sys
S3 MHN;MHN;C:\WINDOWS\System3 2\svchost. exe -k netsvcs
S3 MHNDRV;MHN driver;C:\WINDOWS\system32 \DRIVERS\m hndrv.sys
S3 MPE;BDA MPE Filter;C:\WINDOWS\system32 \DRIVERS\M PE.sys
S3 ROOTMODEM;Microsoft Legacy Modem Driver;C:\WINDOWS\system32 \Drivers\R ootMdm.sys
S3 sdbus;sdbus;C:\WINDOWS\sys tem32\DRIV ERS\sdbus. sys
S3 STHDA;SigmaTel High Definition Audio CODEC;C:\WINDOWS\system32\ drivers\st hda.sys
S3 TcUsb;TC USB Kernel Driver;C:\WINDOWS\system32 \Drivers\t cusb.sys
S3 tifm21;tifm21;C:\WINDOWS\s ystem32\dr ivers\tifm 21.sys
S3 toshidpt;TOSHIBA Bluetooth HID port driver;C:\WINDOWS\system32 \drivers\T oshidpt.sy s
S3 tosporte;Bluetooth Port Driver from Toshiba;C:\WINDOWS\system3 2\DRIVERS\ tosporte.s ys
S3 Tosrfbd;Bluetooth RFBUS from TOSHIBA;C:\WINDOWS\system3 2\Drivers\ tosrfbd.sy s
S3 Tosrfbnp;Bluetooth RFBNEP from TOSHIBA;C:\WINDOWS\system3 2\Drivers\ tosrfbnp.s ys
S3 Tosrfhid;Bluetooth RFHID from TOSHIBA;C:\WINDOWS\system3 2\DRIVERS\ Tosrfhid.s ys
S3 tosrfnds;Bluetooth Personal Area Network from TOSHIBA;C:\WINDOWS\system3 2\DRIVERS\ tosrfnds.s ys
S3 TosRfSnd;Bluetooth Audio Device (WDM) from TOSHIBA;C:\WINDOWS\system3 2\drivers\ TosRfSnd.s ys
S3 Tosrfusb;Bluetooth USB Controller;C:\WINDOWS\syst em32\Drive rs\tosrfus b.sys
S3 ttv300x;TOSHIBA PCI TV Tuner;C:\WINDOWS\system32\ drivers\tt v300x.sys
S3 ttv400x;TOSHIBA PCI DVB-T/Analog Hybrid Tuner;C:\WINDOWS\system32\ drivers\tt v400x.sys
*Newly Created Service* - COMHOST
Contents of the 'Scheduled Tasks' folder
2007-07-31 03:03:04 C:\WINDOWS\Tasks\AppleSoft wareUpdate .job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
2007-07-20 09:06:14 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Rod.job - C:\PROGRA~1\NORTON~1\NORTO N~1\Navw32 .exe
************************** ********** ********** ********** ********** ********
catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-07 08:07:06
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden registry entries ...
[HKEY_LOCAL_MACHINE\SOFTWA RE\Microso ft\Windows \CurrentVe rsion\Unin stall\{E9F 81423-211E -46B6-9AE0 -38568BC5C F6F}]
"DisplayName"="Alcohol 120"
scanning hidden files ...
scan completed successfully
hidden files: 0
************************** ********** ********** ********** ********** ********
Completion time: 2007-08-07 8:07:35
Scan saved at 8:18:27 a.m., on 7/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode with network support
Running processes:
C:\WINDOWS\System32\smss.e
C:\WINDOWS\system32\winlog
C:\WINDOWS\system32\servic
C:\WINDOWS\system32\lsass.
C:\WINDOWS\system32\svchos
C:\WINDOWS\system32\svchos
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EX
C:\WINDOWS\system32\ctfmon
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EX
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepa
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThi
R0 - HKCU\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-7
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-0
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-2
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-7
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-C
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-2
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-0
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.ex
O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\system32\00THot
O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe
O4 - HKLM\..\Run: [TFNF5] TFNF5.exe
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
O4 - HKLM\..\Run: [TouchED] C:\Program Files\TOSHIBA\TouchED\Touc
O4 - HKLM\..\Run: [TosHKCW.exe] "C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe"
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [TPSODDCtl] TPSODDCtl.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [Kraidman] C:\Program Files\TOSHIBA\TOSHIBA RAID\Console\Kraidman.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DL
O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Protector Suite QL\launcher.exe" /startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynT
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\Z
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\i
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCh
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobs
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\reals
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.
O4 - HKLM\..\Run: [SDFix] C:\SDFix\RunThis.bat /second
O4 - HKLM\..\RunOnce: [SDFix] C:\SDFix\RunThis.bat /second
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\tos
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.ex
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbar
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Ad
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASS
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-0
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-0
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-0
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-0
O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)
O16 - DPF: {6E32070A-766D-4EE6-879C-D
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDev
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcg
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\C
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAM
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\E
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService
O23 - Service: TOSHIBA RAID Service (kraidsvc) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TOSHIBA RAID\Service\kraidsvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEU
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc3
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\R
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\stacsv.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServi
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.ex
combofix
ComboFix 07-08-04.3 - "Rod" 2007-08-07 8:04:35.1 [GMT 12:00] - NTFS [SAFE MODE]
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.
((((((((((((((((((((((((( Files Created from 2007-07-06 to 2007-08-06 ))))))))))))))))))))))))))
2007-08-07 08:04 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-08-06 15:20 <DIR> d-------- C:\WINDOWS\ERUNT
2007-08-03 08:08 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLI
2007-08-03 08:06 <DIR> d-------- C:\Program Files\VideoCAM Eye
2007-08-03 08:06 <DIR> d-------- C:\Program Files\Common Files\VCAMEye
2007-08-03 08:04 <DIR> d-------- C:\Program Files\Common Files\DirectX
2007-08-02 14:18 <DIR> d--hs---- C:\WINDOWS\CSC
2007-08-01 17:00 7,077,888 --a------ C:\DOCUME~1\Rod\ntuser.dat
2007-07-31 15:15 <DIR> d-------- C:\Program Files\iTunes
2007-07-31 15:13 <DIR> d-------- C:\Program Files\Common Files\Apple
2007-07-31 15:07 <DIR> d-------- C:\Program Files\QuickTime
2007-07-12 22:08 98,304 --a------ C:\WINDOWS\system32\rsnpst
2007-07-12 22:08 61,440 --a------ C:\WINDOWS\system32\csnpst
2007-07-12 22:08 53,248 --a------ C:\WINDOWS\system32\dsnpst
2007-07-12 22:08 390,912 --a------ C:\WINDOWS\system32\driver
2007-07-12 22:08 36,864 --a------ C:\WINDOWS\system32\vsnpst
2007-07-12 22:08 286,720 --a------ C:\WINDOWS\vsnpstd.exe
2007-07-12 22:08 <DIR> d-------- C:\WINDOWS\Album
2007-07-08 03:09 1,100 --a------ C:\WINDOWS\system32\d3d8ca
((((((((((((((((((((((((((
2007-08-07 00:14 --------- d-------- C:\DOCUME~1\Rod\SendTo\APP
2007-08-04 00:27 --------- d-------- C:\Program Files\e-Sword
2007-08-03 08:06 --------- d-------- C:\Program Files\Common Files\Symantec Shared
2007-07-31 19:33 --------- d-------- C:\DOCUME~1\Rod\SendTo\APP
2007-07-31 15:15 --------- d-------- C:\Program Files\iPod
2007-07-26 20:20 --------- d-------- C:\DOCUME~1\Rod\SendTo\APP
2007-07-17 11:13 --------- d-------- C:\Program Files\Norton Internet Security
2007-07-13 11:13 43520 --a------ C:\WINDOWS\system32\CmdLin
2007-07-12 22:08 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-07-05 15:41 --------- d-------- C:\Program Files\EA GAMES
2007-06-18 00:40 4581246 --a------ C:\WINDOWS\Screensaver-Sli
2007-06-17 14:36 --------- d-------- C:\Program Files\Smart PDF Converter
2007-06-16 15:20 --------- d-------- C:\DOCUME~1\Rod\SendTo\APP
2007-06-16 14:05 --------- d-------- C:\Program Files\SolidDocuments
2007-06-16 01:08 --------- d-------- C:\Program Files\VeryPDF PDF2Word v3.0
2007-06-13 11:36 --------- d-------- C:\Program Files\FLVPlayer
2007-06-13 11:30 --------- d-------- C:\Program Files\FLV Player
2007-05-17 03:12 86528 -----c--- C:\WINDOWS\system32\dllcac
2007-05-17 03:12 85504 -----c--- C:\WINDOWS\system32\dllcac
2007-05-17 03:12 683520 --a------ C:\WINDOWS\system32\inetco
2007-05-17 03:12 683520 -----c--- C:\WINDOWS\system32\dllcac
2007-05-17 03:12 510976 -----c--- C:\WINDOWS\system32\dllcac
2007-05-17 03:12 1314816 -----c--- C:\WINDOWS\system32\dllcac
2006-08-02 14:25 2327233 --a------ C:\Program Files\audacity-win-1.2.4b.
2006-05-26 20:22 45511810 --a------ C:\Program Files\NIS06910AP_2YR.exe
2006-05-12 00:01 2719485 --a------ C:\Program Files\amp.exe
2003-07-25 11:38 132096 --a------ C:\Program Files\Common Files\PCSBoff.exe
((((((((((((((((((((((((((
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWA
"ehTray"="C:\WINDOWS\ehome
"00THotkey"="C:\WINDOWS\sy
"000StTHK"="000StTHK.exe" [2001-06-24 00:28 C:\WINDOWS\system32\000StT
"TFNF5"="TFNF5.exe" [2005-12-09 13:36 C:\WINDOWS\system32\TFNF5.
"SmoothView"="C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2005-04-27 12:13]
"TouchED"="C:\Program Files\TOSHIBA\TouchED\Touc
"TosHKCW.exe"="C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe" [2005-05-18 07:42]
"NDSTray.exe"="NDSTray.exe
"TPSMain"="TPSMain.exe" [2005-12-06 20:25 C:\WINDOWS\system32\TPSMai
"TPSODDCtl"="TPSODDCtl.exe
"TFncKy"="TFncKy.exe" []
"Kraidman"="C:\Program Files\TOSHIBA\TOSHIBA RAID\Console\Kraidman.exe"
"DLA"="C:\WINDOWS\System32
"PSQLLauncher"="C:\Program
"NvCplDaemon"="C:\WINDOWS\
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynT
"IntelZeroConfig"="C:\Prog
"IntelWireless"="C:\Progra
"NeroFilterCheck"="C:\WIND
"Synchronization Manager"="C:\WINDOWS\syste
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-22 22:19]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\reals
"Omnipage"="C:\Program Files\ScanSoft\OmniPageSE\
"AGRSMMSG"="AGRSMMSG.exe" [2005-10-15 06:29 C:\WINDOWS\agrsmmsg.exe]
"SigmatelSysTrayApp"="stsy
"McDiags AutoLaunch"="" []
"snpstd"="C:\WINDOWS\vsnps
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe
"iTunesHelper"="C:\Program
"SDFix"="C:\SDFix\RunThis.
[HKEY_CURRENT_USER\SOFTWAR
"TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\tos
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe
"Skype"="C:\Program Files\Skype\Phone\Skype.ex
"swg"="C:\Program Files\Google\GoogleToolbar
"ctfmon.exe"="C:\WINDOWS\s
[HKEY_LOCAL_MACHINE\softwa
"SDFix"=C:\SDFix\RunThis.b
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Ad
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2005-12-08 10:01:32]
RAMASST.lnk - C:\WINDOWS\system32\RAMASS
[HKEY_LOCAL_MACHINE\softwa
"InstallVisualStyle"=C:\WI
"InstallTheme"=C:\WINDOWS\
[HKEY_LOCAL_MACHINE\softwa
psqlpwd.dll 2005-12-22 17:42 40448 C:\WINDOWS\system32\psqlpw
[HKEY_LOCAL_MACHINE\system
"Notification Packages"= scecli psqlpwd
R0 KR10N;KR10N;C:\WINDOWS\sys
R0 prohlp02;StarForce Protection Helper Driver v2;C:\WINDOWS\system32\dri
R0 prosync1;StarForce Protection Synchronization Driver v1;C:\WINDOWS\system32\dri
R0 sfhlp01;StarForce Protection Helper Driver;C:\WINDOWS\system32
R0 TVALZ;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Driver;C:\WINDOWS\system32
R0 Vax347b;Vax347b;C:\WINDOWS
R0 Vax347s;Vax347s;C:\WINDOWS
R1 meiudf;meiudf;C:\WINDOWS\s
R3 e1express;Intel(R) PRO/1000 PCI Express Network Connection Driver;C:\WINDOWS\system32
R3 Iviaspi;IVI ASPI Shell;C:\WINDOWS\system32\
R3 SynTP;Synaptics TouchPad Driver;C:\WINDOWS\system32
R3 tosrfec;Bluetooth ACPI from TOSHIBA;C:\WINDOWS\system3
R3 w39n51;Intel(R) PRO/Wireless 3945ABG Adapter Driver;C:\WINDOWS\system32
S1 prodrv06;StarForce Protection Environment Driver v6;C:\WINDOWS\system32\dri
S1 Tosrfcom;Bluetooth RFCOMM from TOSHIBA;C:\WINDOWS\system3
S2 FdRedir;FdRedir;\??\C:\Pro
S2 FileDisk2;FileDisk Protector Kernel Driver;\??\C:\Program Files\Common Files\Protector Suite QL\Drivers\filedisk.sys
S2 Netdevio;TOSHIBA Network Device Usermode I/O Protocol;C:\WINDOWS\system
S2 s24trans;WLAN Transport;C:\WINDOWS\syste
S2 smihlp;SMI helper driver;\??\C:\Program Files\Protector Suite QL\smihlp.sys
S2 TOS_SPS;TOSHIBA SPS Driver;\??\C:\Program Files\TOSHIBA\TMP2VDec\TOS
S3 CE3;Xircom Ethernet Adapter 10/100 Service;C:\WINDOWS\system3
S3 E100B;Intel(R) PRO Network Connection Driver;C:\WINDOWS\system32
S3 lredbooo;lredbooo;\??\C:\D
S3 MHN;MHN;C:\WINDOWS\System3
S3 MHNDRV;MHN driver;C:\WINDOWS\system32
S3 MPE;BDA MPE Filter;C:\WINDOWS\system32
S3 ROOTMODEM;Microsoft Legacy Modem Driver;C:\WINDOWS\system32
S3 sdbus;sdbus;C:\WINDOWS\sys
S3 STHDA;SigmaTel High Definition Audio CODEC;C:\WINDOWS\system32\
S3 TcUsb;TC USB Kernel Driver;C:\WINDOWS\system32
S3 tifm21;tifm21;C:\WINDOWS\s
S3 toshidpt;TOSHIBA Bluetooth HID port driver;C:\WINDOWS\system32
S3 tosporte;Bluetooth Port Driver from Toshiba;C:\WINDOWS\system3
S3 Tosrfbd;Bluetooth RFBUS from TOSHIBA;C:\WINDOWS\system3
S3 Tosrfbnp;Bluetooth RFBNEP from TOSHIBA;C:\WINDOWS\system3
S3 Tosrfhid;Bluetooth RFHID from TOSHIBA;C:\WINDOWS\system3
S3 tosrfnds;Bluetooth Personal Area Network from TOSHIBA;C:\WINDOWS\system3
S3 TosRfSnd;Bluetooth Audio Device (WDM) from TOSHIBA;C:\WINDOWS\system3
S3 Tosrfusb;Bluetooth USB Controller;C:\WINDOWS\syst
S3 ttv300x;TOSHIBA PCI TV Tuner;C:\WINDOWS\system32\
S3 ttv400x;TOSHIBA PCI DVB-T/Analog Hybrid Tuner;C:\WINDOWS\system32\
*Newly Created Service* - COMHOST
Contents of the 'Scheduled Tasks' folder
2007-07-31 03:03:04 C:\WINDOWS\Tasks\AppleSoft
2007-07-20 09:06:14 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Rod.job - C:\PROGRA~1\NORTON~1\NORTO
**************************
catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-07 08:07:06
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden registry entries ...
[HKEY_LOCAL_MACHINE\SOFTWA
"DisplayName"="Alcohol 120"
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************
Completion time: 2007-08-07 8:07:35
Stunning. I can only say that the amount of HKLM\...\Run and HKCU\....\Run keys is just huge. I usually aim for <5 such entries. The possibility of a software incompatibility is not unthinkable here. Some sort of cleanout would be my first move.
/RID
/RID
ASKER
OK. I'm fully ignorant. Talk me through "cleanout".
OK, I'm a bit rabid when it comes to autostarting items, which is what those entries are. My view may not be representative of the normal view among windows users. However, the principle is that you identify the crucial processes (for a laptop, that would in my view include the touchpad driver (SyntpEnh), the wireless driver if you are on wireless network, and the antivirus) and then you delete the rest of the keys.
However, messing with the registry may cause odd effects; if something important is removed from here, some functions you like may disappear. I can't expand on this until later today, so perhaps someone with a more sensible view on autostart may be able to helt you before that.
Cheers
/RID
However, messing with the registry may cause odd effects; if something important is removed from here, some functions you like may disappear. I can't expand on this until later today, so perhaps someone with a more sensible view on autostart may be able to helt you before that.
Cheers
/RID
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
I concur with last post, I've found these to generally be RAM related. Crack the case, clean the board, if more than one RAM module; try booting with one stick at a time, make sure both sticks are ID'd in the BIOS, delete the page file and then recreate it.
While in safe mode check the event viewer in the control panel-->administrative tools for indications of what may be implicated. Post any recent events marked red, here.
Here are some 0x50 troubleshooting guidelines. http://www.aumha.org/a/stop.php#0x50