Win XP MCE - Major malfunction

OK we need info on what the system is doing!

Copy the text between the lines but not the lines.

--------------------------------------------------------
%SystemRoot%\system32\cmd.exe /c %windir%\system32\tasklist.exe /svc >> "%USERPROFILE% "\Desktop\Tasklist.txt
----------------------------------------------------------

then
Start-Run
type cmd
hit enter or click OK

rt click in the open cmd screen and rt then paste
hit enter twice

Now repeat the same process with the below

----------------------------------------------------------
%SystemRoot%\system32\cmd.exe /c %windir%\system32\sc query type= service > "%USERPROFILE% "\Desktop\ScQuery.txt
----------------------------------------------------------

And this
----------------------------------------------------------
%SystemRoot%\system32\cmd.exe /c %windir%\system32\ipconfig /all > "%USERPROFILE% "\Desktop\ipfig.txt
----------------------------------------------------------

And this
----------------------------------------------------------
%SystemRoot%\system32\cmd.exe /c %windir%\system32\net use > "%USERPROFILE% "\Desktop\netuse.txt
----------------------------------------------------------

then

close cmd prompt

Now there are 3 new icons on the desktop Tasklist.txt, ScQuery.txt andipfig.txt

Post back contents of both!

Then back to DAF Hammerhead (2nd page) run
SFC Purge
then
SFC Scan

If DAF needs files browse to I386 folder.

Mike

 

Tasklist.txt:


Image Name PID Services
========================= ====== =============================================
System Idle Process 0 N/A
System 4 N/A
smss.exe 452 N/A
csrss.exe 516 N/A
winlogon.exe 540 N/A
services.exe 588 Eventlog, PlugPlay
lsass.exe 600 ProtectedStorage, SamSs
svchost.exe 756 DcomLaunch, TermService
svchost.exe 812 RpcSs
svchost.exe 864 AudioSrv, CryptSvc, Dhcp, dmserver, ERSvc,
EventSystem, FastUserSwitchingCompatibility,
helpsvc, HidServ, lanmanserver,
lanmanworkstation, Netman, NtmsSvc,
Schedule, seclogon, SENS, ShellHWDetection,
srservice, TapiSrv, Themes, TrkWks, W32Time,
winmgmt, wscsvc, WZCSVC
svchost.exe 908 WudfSvc
svchost.exe 964 Dnscache
svchost.exe 1004 LmHosts, RemoteRegistry, WebClient
explorer.exe 1280 N/A
aswUpdSv.exe 1488 aswUpdSv
spoolsv.exe 1580 Spooler
a2service.exe 1920 a2free
ehrecvr.exe 1980 ehRecvr
ehSched.exe 2000 ehSched
IAANTMon.exe 240 IAANTMon
nvsvc32.exe 420 NVSvc
svchost.exe 428 Pml Driver HPZ12
PRISMXL.SYS 252 PrismXL
QBCFMonitorService.exe 488 QBCFMonitorService
svchost.exe 1164 stisvc
ELService.exe 1400 ELService
dllhost.exe 2176 COMSysApp
ehtray.exe 2372 N/A
ehmsas.exe 2408 N/A
rundll32.exe 2456 N/A
mHotkey.exe 2476 N/A
CNYHKey.exe 2500 N/A
readericon45G.exe 2548 N/A
IAAnotif.exe 2588 N/A
WinPatrol.exe 2608 N/A
TopSecretsDirect.exe 2628 N/A
DoroServer.exe 2776 N/A
iTunesHelper.exe 2796 N/A
zlclient.exe 2972 N/A
ctfmon.exe 2988 N/A
MSOFFICE.EXE 3136 N/A
qbupdate.exe 3208 N/A
Ding.exe 3292 N/A
iPodService.exe 1656 iPod Service
cmd.exe 3088 N/A
vsmon.exe 2556 N/A
cmd.exe 2652 N/A
tasklist.exe 2560 N/A
wmiprvse.exe 2600 N/A

 

ScQuery.txt:

[SC] EnumQueryServicesStatus:OpenService FAILED 1060:

The specified service does not exist as an installed service.



ipfig.txt:



Error: unrecongnized or incomplete command line.



USAGE:

ipconfig [/? | /all | /renew [adapter] | /release [adapter] |

/flushdns | /displaydns | /registerdns |

/showclassid adapter |

/setclassid adapter [classid] ]



where

adapter Connection name

(wildcard characters * and ? allowed, see examples)



Options:

/? Display this help message

/all Display full configuration information.

/release Release the IP address for the specified adapter.

/renew Renew the IP address for the specified adapter.

/flushdns Purges the DNS Resolver cache.

/registerdns Refreshes all DHCP leases and re-registers DNS names

/displaydns Display the contents of the DNS Resolver Cache.

/showclassid Displays all the dhcp class IDs allowed for adapter.

/setclassid Modifies the dhcp class id.



The default is to display only the IP address, subnet mask and

default gateway for each adapter bound to TCP/IP.



For Release and Renew, if no adapter name is specified, then the IP address

leases for all adapters bound to TCP/IP will be released or renewed.



For Setclassid, if no ClassId is specified, then the ClassId is removed.



Examples:

> ipconfig ... Show information.

> ipconfig /all ... Show detailed information

> ipconfig /renew ... renew all adapters

> ipconfig /renew EL* ... renew any connection that has its

name starting with EL

> ipconfig /release *Con* ... release all matching connections,

eg. "Local Area Connection 1" or

"Local Area Connection 2 "

 

Can't "browse "... it demands the CD.

The CD needed is AWOL. . . . . .

 

Hmm Deck

Bring me up to date as to what does and does not work!

You are in a bad way here, lots missing!

You need a "Repair install of XP" and no CD to do it with. Can you borrow one from some one. If you do you will need your Microsoft Key and will have to re-activate.

I also wish you would get completely rid of ZA until the computer is fixed of everything else.

Try this (as I am not sure what all works on your computer now).

Uninstall ZA again.

Reboot then do a windows search with advanced options for Zone*.* and truev*.* and vsmon*.* and delete all that apply to ZoneAlarn, Truevector and Vsmon.

The use regseeker or Regedit to serarch for the same and delete from registry (don't use *.* in reg search).

Look in Device manager for any device errors (yellow Exclamations or Red X's) uninstall them.

Only after the above:

Go into Device manager and uninstall the Network card and hope it reinstalls on boot.

Mike

 

You know when you hit that certain point in trying to find a way to fix something and you just know there has to be some way to do it but everything points to (in the case of computers) "You need the CD that you've misplaced so you are S.O.L., buddy!" but you know, deep in your heart, that somebody, somewhere actually put an ememgency escape hatch in place for those of us who have trouble with any book in the "The Complete Idiots Guide..." series, and then you happen to stumble across one little line buried deep within the support pages for your computer... and you say to yourself, because your wife really doesn't want to hear from you since, obviously, YOU messed up the computer AGAIN and she's feeling really bad because she KNOWS you really want to blame the kids AGAIN but they're away at camp, "NO, it can't be this simple, can it? "

Gateway has it's own "restore" program, right on the hard drive. And yes, I knew it was there. However, I thought you RAN it from the "D:" drive. Oops.

So, as I type this, Gateway's restore seemed to be working...

... except we are now stuck at "Application 6 of 70 ".

So... I'm off to see if Gateway can help me get things progressing.

I'll be back......

 

Well, THAT was helpful.

The short version:

Yada Yada Yada ... insert CD ...

When told I couldn't find the CDs:

I was sent a link for a DESTRUCTIVE FULL RESTORE... and I STILL need the CDs. Never mind that I'm trying NOT to lose everything on the hard drive.

SO... anybody have a suggestion?

 

For any & everybody who's followed this thread...

1 - Sometimes you get lucky. I restarted the computer. It continued to load Windows...
2 - This computer had been "qwirky" for a while. Don't ignore "qwirks ".
3 - Teenagers. 'Nuf said.
4 - Looks like I only lost the stuff on my Desktop. Unfortunately, I had a lot there. My teenagers thought that was dumb.

Don't ignore your teenagers.

 

Hi Deck

OK while stable (appearently) finish cleaning ZA. I really beleive that was the beginning of your problem.

Let me know and I will give the deep clean instructions for ZA.

It needs to be deeply cleaned. Even if (pray not) you are going to reinstall it instead of a good Firewall like Comodo!

From your description it sounds like you blew your Logon Profile and if so:

Run My Computer- Tools-Folder Options-View. Select Show hidden files and folders.

Then browse to C:\Documents and Folders, look at the profile names, you likely have one named Deck (or what ever logon name you were using) and another with the same name with and extension like Deck.abcde.

If so the Deck.abcde is now your logon and your old Desktop files will be in
C:\Documents and Folders\Deck\Desktop! Copy these files to a folder (not Desktop) the kids were right.

If you do have this Deck.abcde (automaticly created by Windows) (the abcde is an example) it could be the computername etc. Then let me know after you retrieve your desktop files and I will give you directions to correct it.

Additionally do a System restore point now!

Also get:

ERUNT Registry backup http://www.larshederer.homepage.t-online.de/erunt/
Install let it add entry to Startup and let it back up now.

Mike

 

Hi Mike!

I was away most of last week. This week I'll be catching up and moving on...

1st: migrating to my Vista machine as my primary computer.
2nd: locating the CD that came with the (now almost useless) XP computer.
3rd: switching the rest of my computers to Comodo (which IS on the Gateway XP)

(I did look for profile names --- there isn't any)

While the (now "old ") Gateway XP computer is now running, it is right now just a holding center of everything that was on it (and saved from destruction). Once I find the lost CD, then perhaps I can get everything working on it again.

I do want to go through and make sure that ZoneAlarm is indeed gone for good on it. I will also want to do the same on my other computers as I change them over to Comodo. So, if you could, I'd really like the instructions for fully removing ZoneAlarm.

And now, since it's "off-topic" here, I'm off to get advice on email on Vista...

(and has there been a change on the board, or did I miss a memo, or... ? I keep having to re-log in to the board if I haven't "done" anything in a few minutes...)

Arthur

 

Is that why there is a lot of "white space "?
ie. the top of your post and the left side of other posts......

And on the top of this post !!!!!!!!

mickzer.

 

OK, just adjustments. It's good to know I wasn't having more issues!

mickzer, I'm not getting any "white spaces ", but I am getting Google ads in the places you mentioned.

Arthur

 

It seems to rectify itself when another post is added, but this is what I mean.
http://i12.photobucket.com/albums/a231/mickzer/Whitespace.jpg

mickzer.

 

Yep, you're missing the Google Ads. They are appearing in the "newest" reply.