1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Windows XP start up problem [HJT log]

Discussion in 'Malware and Virus Removal Archive' started by shnikes, 2005/03/07.

Thread Status:
Not open for further replies.
Page 1 of 2
  1. 2005/03/07
    shnikes

    shnikes Inactive Thread Starter

    Joined:
    2005/02/18
    Messages:
    42
    Likes Received:
    0
    Windows XP start up problem

    A few weeks ago, I had a problem with popups, and it has been solved.
    A few days before that problem was solved, the computer started to act strangely. Whenever I would turn on the computer and log on for the first time, the internet connection would be disconnected, and the norton auto protection thing would be disabled. Also, I couldn't open any folders or run any new programs without having them freeze up on me. So I tried logging off, and the computer would start to shut down programs, show an empty screen with just the background picture, and freeze, or so it seemed. After leaving the computer alone for 4 to 5 minutes, it started the logging off progress. After logging off, I logged on again. This time, everything worked well. This has been going on for quite some time now, and I don't know what is the matter...
     
    shnikes,
    #1
  2. 2005/03/07
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    At a guess this may be a good place to start ....

    Are you sure that your computer is free from malware, etc? Have you run Ad-Aware and Spybot - fully updated and Microsoft AntiSpyware - all downloadable through Quicklinks in my sig.

    If it appears to be clean download HijackThis (Quicklinks), save it to a folder on your drive, say C:\HijackThis, not the desktop, run it and post the log here.
     
    PeteC,
    #2


  3. to hide this advert.

  4. 2005/03/07
    shnikes

    shnikes Inactive Thread Starter

    Joined:
    2005/02/18
    Messages:
    42
    Likes Received:
    0
    Thanx.
    I ran the programs you mentioned, and they detected some adwares.
    After reboot, and a rescan, they were not detected again.
    But the problem persists..
    Here's my Hijackthis log.

    Logfile of HijackThis v1.99.1
    Scan saved at 오전 10:52:01, on 2005-03-07
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Ahnlab\Smart Update Utility\AhnSDsv.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\WINDOWS\AGRSMMSG.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\WINDOWS\ATK0100\Hcontrol.exe
    C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
    C:\Program Files\SAMSUNG\Keydefin\KeyDefin.exe
    C:\PROGRA~1\NORTON~1\navapw32.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
    C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\ATK0100\ATKOSD.exe
    C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe
    C:\Hijackthis\HijackThis.exe

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: V3 - {9E3849D6-41EF-4B2F-86B7-632EF90758E4} - C:\Program Files\Ahnlab\V3\V3Bar.dll
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [Hcontrol] C:\WINDOWS\ATK0100\Hcontrol.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
    O4 - HKLM\..\Run: [SAMSUNG Keydefin] C:\Program Files\SAMSUNG\Keydefin\KeyDefin.exe
    O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
    O4 - HKLM\..\Run: [imekrmig] C:\Program Files\Common Files\Microsoft Shared\IME\IMKR\imekrmig.exe
    O4 - HKLM\..\Run: [PRISMSVR.EXE] "C:\WINDOWS\system32\PRISMSVR.EXE" /APPLY
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
    O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe "
    O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe "
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe "
    O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe "
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [joinsland] "C:\Program Files\CoolAgent\avachat-joinsland.exe" -env http://rss.joinsland.com/env.xml
    O8 - Extra context menu item: Microsoft Excel로 내보내기(&X) - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
    O9 - Extra 'Tools' menuitem: Sun Java 콘솔 - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: http://*.buddybuddy.co.kr (HKLM)
    O23 - Service: AhnLab Task Scheduler - AhnLab, Inc. - C:\Program Files\Ahnlab\Smart Update Utility\AhnSDsv.exe
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: MonSvcNT - Ahnlab, Inc. - C:\Program Files\Ahnlab\V3\MonSvcNT.EXE
    O23 - Service: Norton AntiVirus 자동 보호 서비스 (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: npkcsvc - INCA Internet Co., Ltd. - C:\WINDOWS\system32\npkcsvc.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
     
    shnikes,
    #3
  5. 2005/03/07
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    OK - I'm no expert in HJT logs and am moving this thread to the Removing Spyware and Viruses forum where one of our experts will take a look at it - this may take a while as they are hard pressed these days.

    In the meantime it would do no harm to run System File Checker ....

    Start > Run > sfc /scannow - note the space and have your XP CD handy. SFC will run and exit without any closing dialogue. To see which files, if any, have been replaced look in Event Viewer.

    While in Event Viewer take a look at any error messages which are flagged yellow or red, especially any that are timed to coincide with a boot up. Double click on a message to open it and on the icon below the up/down arrows to copy to clipboard and paste any relevant messages here.
     
    PeteC,
    #4
  6. 2005/03/07
    shnikes

    shnikes Inactive Thread Starter

    Joined:
    2005/02/18
    Messages:
    42
    Likes Received:
    0
    This is my first time looking at the Event Viewer.
    How do I know if any programs have been moved?
    There are so many yellows and reds I don't know if they are relevant or not.
     
    shnikes,
    #5
  7. 2005/03/07
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    This illustrates the size of your problem, although many may be duplicates. They all represent a problem and require attention - those flagged red are major errors.

    All the messages have a time stamp so your best bet is to close down the computer - note the time and reboot. When you are up and running look again in Event Viewer and copy/paste the contents of those error messages which are red flagged - System and Application - timed to coincide with the bootup here.
     
    PeteC,
    #6
  8. 2005/03/07
    shnikes

    shnikes Inactive Thread Starter

    Joined:
    2005/02/18
    Messages:
    42
    Likes Received:
    0
    Oh..there were only three yellows that were replaced today at the time of restart.
    Here they are...

    이벤트 형식: 경고
    이벤트 원본: Userenv
    이벤트 범주: 없음
    이벤트 ID: 1517
    날짜: 2005-03-07
    시간: 오후 12:58:53
    사용자: NT AUTHORITY\SYSTEM
    컴퓨터: LAPTOP
    설명:
    응용 프로그램 또는 서비스에서 로그오프하는 동안 사용되는 사용자 LAPTOP\JW 레지스트리를 저장했습니다. 사용자의 레지스트리에서 사용하던 메모리를 사용할 수 없습니다. 레지스트리를 더 이상 사용하지 않게 되면 언로드합니다.

    사용자 계정으로 실행되는 서비스 때문일 수 있습니다. LocalService 또는 NetworkService 계정으로 실행하도록 구성하십시오.

    자세한 정보는 http://go.microsoft.com/fwlink/events.asp에 있는 도움말 및 지원 센터를 참조하십시오.
    이벤트 형식: 경고
    이벤트 원본: Win32k
    이벤트 범주: 없음
    이벤트 ID: 240
    날짜: 2005-03-07
    시간: 오전 12:44:00
    사용자: N/A
    컴퓨터: LAPTOP
    설명:
    전원 일시 중단 요청이 winlogon.exe에 의해 거부되었습니다.

    자세한 정보는 http://go.microsoft.com/fwlink/events.asp에 있는 도움말 및 지원 센터를 참조하십시오.
    데이터:
    0000: 00 00 00 00 02 00 4e 00 ......N.
    0008: 00 00 00 00 f0 00 00 80 ....ð..€
    0010: 00 00 00 00 00 00 00 00 ........
    0018: 00 00 00 00 00 00 00 00 ........
    0020: 00 00 00 00 00 00 00 00 ........
    이벤트 형식: 경고
    이벤트 원본: Win32k
    이벤트 범주: 없음
    이벤트 ID: 240
    날짜: 2005-03-07
    시간: 오전 12:44:05
    사용자: N/A
    컴퓨터: LAPTOP
    설명:
    전원 일시 중단 요청이 winlogon.exe에 의해 거부되었습니다.

    자세한 정보는 http://go.microsoft.com/fwlink/events.asp에 있는 도움말 및 지원 센터를 참조하십시오.
    데이터:
    0000: 00 00 00 00 02 00 4e 00 ......N.
    0008: 00 00 00 00 f0 00 00 80 ....ð..€
    0010: 00 00 00 00 00 00 00 00 ........
    0018: 00 00 00 00 00 00 00 00 ........
    0020: 00 00 00 00 00 00 00 00 ........
     
    shnikes,
    #7
  9. 2005/03/07
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    Something a bit odd with your error message - the way in which it has copied and pasted. Did you click on the icon below the up/down arrows and paste into your post? A typical error pasted here looks like this ....


    Would be interested to see what the red flagged error messages refer to - post a couple.

    Did you run System File Checker?
     
    PeteC,
    #8
  10. 2005/03/07
    shnikes

    shnikes Inactive Thread Starter

    Joined:
    2005/02/18
    Messages:
    42
    Likes Received:
    0
    Yes I did run system file checker, but I'll run it again.
    The event viewer info may seem weird because it's not in English..lol
    I don't know if I can change the language.
    Here's some new yellows from this restart.
    Would it help if I (roughly) translated the info?





    이벤트 형식: 경고　　　　　　　　　　 Event Type: Warning
    이벤트 원본: MsiInstaller　　　　　　Event Source: MsiInstaller
    이벤트 범주: 없음 　　　　　　　　　　 Event Category: None
    이벤트 ID: 1001　　　　　　　　　　　　　　　 Event ID: 1001
    날짜: 2005-03-07 　　　　　　 Date: 2005-03-07
    시간: 오후 6:12:29　　　　　　 Time: 18:12:29
    사용자: LAPTOP\JW 　　　　　　 User: LAPTOP\JW
    컴퓨터: LAPTOP 　　　　　　　　　　　　　　 Computer: LAPTOP
    설명: 　　　　　　　　　　　　　　　　　　　　　 Description:
    구성 요소 '{A4AD656D-72E9-43A7- 　　　　　 While requesting component
    9DD0-E5F6AF438E72}'을(를) 요청하는 　　　 '{A4AD656D-72E9-43A7-
    동안 제품 '{43DCF766-6838-4F9A-8C91- 　　　9DD0-E5F6AF438E72}'
    D92DA586DFA7}'의 기능 DefaultFeature 　　　 the function, defaultFeature,
    을(를) 검색하지 못했습니다. 　　　　　　　　　　 of product '{43DCF766-6838
    　　　　　　　　　　　　　　　　　　　　　　　　 -4F9A-8C91-D92DA58
    　　　　　　　　　　　　　　　　　　　　　　　　　　 6DFA7}' was not found.

    자세한 정보는 http://go.microsoft. 　　　　 For more information, see com/fwlink/events.asp에 있는 도움말 　　　 Help and Support Center at
    및 지원 센터를 참조하십시오. 　　　　　　　　　　　 at ttp://go.
    　　　　　　　　　　　　　　　　　　　　　　　　 microsoft.com/fwlink/events.asp.




    이벤트 형식: 경고
    이벤트 원본: MsiInstaller
    이벤트 범주: 없음
    이벤트 ID: 1001
    날짜: 2005-03-07
    시간: 오후 6:12:29
    사용자: NT AUTHORITY\NETWORK SERVICE
    컴퓨터: LAPTOP
    설명:
    구성 요소 '{A4AD656D-72E9-43A7-9DD0-E5F6AF438E72}'을(를) 요청하는 동안 제품 '{43DCF766-6838-4F9A-8C91-D92DA586DFA7}'의 기능 DefaultFeature을(를) 검색하지 못했습니다.

    자세한 정보는 http://go.microsoft.com/fwlink/events.asp에 있는 도움말 및 지원 센터를 참조하십시오.


    이벤트 형식: 경고
    이벤트 원본: MsiInstaller
    이벤트 범주: 없음
    이벤트 ID: 1004
    날짜: 2005-03-07
    시간: 오후 6:12:29
    사용자: NT AUTHORITY\NETWORK SERVICE
    컴퓨터: LAPTOP
    설명:
    제품 '{43DCF766-6838-4F9A-8C91-D92DA586DFA7}', 기능 'DefaultFeature', 구성 요소 '{9F47ECA8-A740-EC80-1AE2-C48048D83AA4}'을(를) 검색하지 못했습니다. 리소스 'HKEY_CURRENT_USER\Software\Microsoft\Journal Viewer\'이(가) 존재하지 않습니다.

    자세한 정보는 http://go.microsoft.com/fwlink/events.asp에 있는 도움말 및 지원 센터를 참조하십시오.

    이벤트 형식: 경고
    이벤트 원본: Userenv
    이벤트 범주: 없음
    이벤트 ID: 1517
    날짜: 2005-03-07
    시간: 오후 5:23:53
    사용자: NT AUTHORITY\SYSTEM
    컴퓨터: LAPTOP
    설명:
    응용 프로그램 또는 서비스에서 로그오프하는 동안 사용되는 사용자 LAPTOP\JW 레지스트리를 저장했습니다. 사용자의 레지스트리에서 사용하던 메모리를 사용할 수 없습니다. 레지스트리를 더 이상 사용하지 않게 되면 언로드합니다.

    사용자 계정으로 실행되는 서비스 때문일 수 있습니다. LocalService 또는 NetworkService 계정으로 실행하도록 구성하십시오.

    자세한 정보는 http://go.microsoft.com/fwlink/events.asp에 있는 도움말 및 지원 센터를 참조하십시오.

    이벤트 형식: 경고
    이벤트 원본: Tcpip
    이벤트 범주: 없음
    이벤트 ID: 4226
    날짜: 2005-03-07
    시간: 오후 6:11:11
    사용자: N/A
    컴퓨터: LAPTOP
    설명:
    TCP/IP가 동시 TCP 연결 시도에 대해 적용한 제한 횟수에 도달했습니다.

    자세한 정보는 http://go.microsoft.com/fwlink/events.asp에 있는 도움말 및 지원 센터를 참조하십시오.
    데이터:
    0000: 00 00 00 00 01 00 54 00 ......T.
    0008: 00 00 00 00 82 10 00 80 ....‚..€
    0010: 01 00 00 00 00 00 00 00 ........
    0018: 00 00 00 00 00 00 00 00 ........
    0020: 00 00 00 00 00 00 00 00 ........



    Here are some of the reds...

    이벤트 형식: 오류
    이벤트 원본: crypt32
    이벤트 범주: 없음
    이벤트 ID: 11
    날짜: 2005-02-16
    시간: 오전 9:12:18
    사용자: N/A
    컴퓨터: LAPTOP
    설명:
    다음 오류와 함께 <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>의 자동 업데이트 CAB에서 제3 루트 목록의 추출에 실패하였습니다. 현재 시스템 시간을 확인하거나 서명된 파일의 스탬프를 확인하는데 필요한 인증서가 유효 기간 내에 있지 않습니다.


    자세한 정보는 http://go.microsoft.com/fwlink/events.asp에 있는 도움말 및 지원 센터를 참조하십시오.

    이벤트 형식: 오류
    이벤트 원본: Norton AntiVirus
    이벤트 범주: (1)
    이벤트 ID: 4097
    날짜: 2005-02-17
    시간: 오전 2:46:00
    사용자: NT AUTHORITY\SYSTEM
    컴퓨터: LAPTOP
    설명:
    이벤트 ID( 4097 )(원본 ( Norton AntiVirus )에 있음)에 대한 설명을 찾을 수 없습니다. 로컬 컴퓨터에 원격 컴퓨터에서 보낸 메시지를 표시하기 위해 필요한 레지스트리 정보 또는 메시지 DLL 파일이 없을 수 있습니다. 이 설명을 검색하는 데 /AUXSOURCE= 플래그를 사용할 수 있습니다. 자세한 정보는 도움말 및 지원을 참조하십시오. 다음 정보는 이벤트의 일부입니다. C:\windows\system32\cp.exe
    파일이
    Trojan dropper 바이러스에 감염되었습니다., 파일에 액세스하지 못했습니다..

    이벤트 형식: 오류
    이벤트 원본: Service Control Manager
    이벤트 범주: 없음
    이벤트 ID: 7000
    날짜: 2005-02-18
    시간: 오후 9:35:52
    사용자: N/A
    컴퓨터: LAPTOP
    설명:
    다음 오류 때문에 bfjhwoliaxrj 서비스를 시작하지 못했습니다:
    지정된 파일을 찾을 수 없습니다.

    자세한 정보는 http://go.microsoft.com/fwlink/events.asp에 있는 도움말 및 지원 센터를 참조하십시오.
     
    Last edited: 2005/03/07
    shnikes,
    #9
  11. 2005/03/07
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Those recent errors appear to be related to
    Do you use it? If not, maybe you'll just want to uninstall it. If so, try re-installing.

    The older ones pertain to junk removed when we cleaned up a while back. Right click the Application, Security and System keys and select clear all events, then let us know what type of errors return.
     
    noahdfear,
    #10
  12. 2005/03/07
    shnikes

    shnikes Inactive Thread Starter

    Joined:
    2005/02/18
    Messages:
    42
    Likes Received:
    0
    the only problem is that it still does that freezing up thing on me..
    this is the only yellow so far...

    이벤트 형식: 경고　　　　　　Event Type: Warning
    이벤트 원본: Userenv　　　　Event Source: Userenv
    이벤트 범주: 없음　　　　　　Event Category: None
    이벤트 ID: 1517　　　　　　　　　　　Event ID: 1517
    날짜: 2005-03-07　　Date: 2005-03-07
    시간: 오후 10:42:27　Time: 22:42:27
    사용자: NT AUTHORITY\SYSTEM　User: NT AUTHORITY\SYSTEM
    컴퓨터: LAPTOP　　　　　　　　　　Computer: LAPTOP
    설명:　　　　　　　　　　　　　　　　　Description:
    The User LAPTOP\JW's registry used when logging off from an application or service was saved. The memory that was used by the user's registry is not usable. When the registry is no longer used, it is unloaded.

    This may be caused by a service running on the user's account. Make it so that it will be run on the LocalService or NetworkService accounts.

    응용 프로그램 또는 서비스에서 로그오프하는 동안 사용되는 사용자 LAPTOP\JW 레지스트리를 저장했습니다. 사용자의 레지스트리에서 사용하던 메모리를 사용할 수 없습니다. 레지스트리를 더 이상 사용하지 않게 되면 언로드합니다.

    사용자 계정으로 실행되는 서비스 때문일 수 있습니다. LocalService 또는 NetworkService 계정으로 실행하도록 구성하십시오.

    자세한 정보는 http://go.microsoft.com/fwlink/events.asp에 있는 도움말 및 지원 센터를 참조하십시오.


    Also this is the change in the event viewer after running a system file check..
    I think the last four are about running the CD-ROM.. The first one is about finishing the file search on windows file protection.. (whatever that means ;) )

    이벤트 형식: 정보
    이벤트 원본: Windows File Protection
    이벤트 범주: 없음
    이벤트 ID: 64017
    날짜: 2005-03-07
    시간: 오후 11:16:00
    사용자: N/A
    컴퓨터: LAPTOP
    설명:
    Windows 파일 보호에서 파일 검색 작업을 완료했습니다.

    자세한 정보는 http://go.microsoft.com/fwlink/events.asp에 있는 도움말 및 지원 센터를 참조하십시오.
    이벤트 형식: 정보
    이벤트 원본: Service Control Manager
    이벤트 범주: 없음
    이벤트 ID: 7035
    날짜: 2005-03-07
    시간: 오후 11:16:23
    사용자: NT AUTHORITY\SYSTEM
    컴퓨터: LAPTOP
    설명:
    IMAPI CD-Burning COM Service 서비스로 시작 컨트롤을 보냈습니다.

    자세한 정보는 http://go.microsoft.com/fwlink/events.asp에 있는 도움말 및 지원 센터를 참조하십시오.
    이벤트 형식: 정보
    이벤트 원본: Service Control Manager
    이벤트 범주: 없음
    이벤트 ID: 7036
    날짜: 2005-03-07
    시간: 오후 11:16:23
    사용자: N/A
    컴퓨터: LAPTOP
    설명:
    IMAPI CD-Burning COM Service 서비스가 실행 상태로 들어갔습니다.

    자세한 정보는 http://go.microsoft.com/fwlink/events.asp에 있는 도움말 및 지원 센터를 참조하십시오.
    이벤트 형식: 정보
    이벤트 원본: Service Control Manager
    이벤트 범주: 없음
    이벤트 ID: 7035
    날짜: 2005-03-07
    시간: 오후 11:16:52
    사용자: NT AUTHORITY\SYSTEM
    컴퓨터: LAPTOP
    설명:
    IMAPI CD-Burning COM Service 서비스로 시작 컨트롤을 보냈습니다.

    자세한 정보는 http://go.microsoft.com/fwlink/events.asp에 있는 도움말 및 지원 센터를 참조하십시오.
    이벤트 형식: 정보
    이벤트 원본: Service Control Manager
    이벤트 범주: 없음
    이벤트 ID: 7036
    날짜: 2005-03-07
    시간: 오후 11:16:52
    사용자: N/A
    컴퓨터: LAPTOP
    설명:
    IMAPI CD-Burning COM Service 서비스가 실행 상태로 들어갔습니다.

    자세한 정보는 http://go.microsoft.com/fwlink/events.asp에 있는 도움말 및 지원 센터를 참조하십시오.
    이벤트 형식: 정보
    이벤트 원본: Service Control Manager
    이벤트 범주: 없음
    이벤트 ID: 7036
    날짜: 2005-03-07
    시간: 오후 11:16:59
    사용자: N/A
    컴퓨터: LAPTOP
    설명:
    IMAPI CD-Burning COM Service 서비스가 중지 상태로 들어갔습니다.

    자세한 정보는 http://go.microsoft.com/fwlink/events.asp에 있는 도움말 및 지원 센터를 참조하십시오.
     
    Last edited: 2005/03/07
    shnikes,
    #11
  13. 2005/03/08
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    I would not worry about the Usernv warning message - this appears on my m/c from time to time and has no effect on the operation of the m/c ....

    This message indicates that System File Checker has completed. Would be much more helpful if it stated just that :)
    This service should be set to Manual - the default (Right Click My Computer icon > Manage > Services and Applications > Services > scroll down to IMAPI CD-Burning COM Service - check Startup Type - Manual)

    None of these warnings should lead to the problems you describe.

    BTW - should have realised that the strange code indicated a language other than English - sorry about that.
     
    PeteC,
    #12
  14. 2005/03/08
    shnikes

    shnikes Inactive Thread Starter

    Joined:
    2005/02/18
    Messages:
    42
    Likes Received:
    0
    no problem ;)
    the cd-rom was set to manual.
    It still freezes..could it be that I'm using up too much of my hard drive?
    it is partitioned to two drives but i'm using almost all of my c drive...
    this has been going on for a long time before the problem surfaced but just in case...
    or maybe before I consulted this board i was fumbling around with registry and i erased something i shouldn't have, although i erased only those that came up on searches as affected by the virus or as adwares.
     
    Last edited: 2005/03/08
    shnikes,
    #13
  15. 2005/03/08
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    How much free space is there on your C: drive?
     
    PeteC,
    #14
  16. 2005/03/08
    shnikes

    shnikes Inactive Thread Starter

    Joined:
    2005/02/18
    Messages:
    42
    Likes Received:
    0
    about 2 gigabytes :eek:
    I'm using about 94%.
     
    shnikes,
    #15
  17. 2005/03/09
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    With only 6% of your C: drive free I would expect performance problems, but I cannot state for certain that it would give the problems you are experiencing.

    However it is a problem that needs addressing ....

    First of all clear out your Temporary Internet files and check the setting for the amount of storage space allowed ....

    In IE > Tools > Internet Options > General Tab > Temporary Internet Files > Delete Files. Then click on the Settings button and in the Settings dialogue box move the slider to the Left to say 50/100 Mb and OK out.

    Then go Start > Run and type in %temp% > OK. A windows Explorer window will open listing all the temporary files on your PC - these can safely be deleted (one or two which are in use will not be deleted - these will have the latest time stamp)

    Empty the Recycle Bin and then Right click on the Icon > Properties. Click on Configure dtives independently and set the amount of space allowed on C: drive to 5% at the most. Say 10% on the other drive.

    Alter the settings of the Page File (Swap file) - this is on your C: drive and by default can vary in size ....

    Righr Click My Computer icon > Properties > Advanced > Performance > Settings button. In the Performance dialogue box click on the Advanced tab > Virtual Memory - change button. The Virtual Memory dialogue box appears - see below ....

    Highlight your second drive (partition) > click on Custom Size and enter a figure equal to 1 1/2 x the amount of RAM installed on your computer in both boxes. (e.g. If you have 512 MB RAM enter 768). Click on Set.

    Then highlight your C: drive and click on No paging file > Set.

    OK out and reboot.

    To avoid any confusion arising from the screenshot please note that I have a partition dedicated to the Page file and also have a small Page file on C: drive for Memory dumps on my set up. You can ignore this :)

    Finally look long and hard at your C: drive and move as much data as you can to your other partition. By data I mean personal data which you have created - documents, spread sheets, picture and music files, etc - not programs or anything in Windows.

    You should be aiming to get the maximum amount of free space on the C: drive as possible, say, at least 20/25%.

    If you are able to do this and the problems are solved - possible, but not at all certain, then fine, but if the problems remain I would suggest a Repair of XP - also see here
     
    PeteC,
    #16
  18. 2005/03/09
    shnikes

    shnikes Inactive Thread Starter

    Joined:
    2005/02/18
    Messages:
    42
    Likes Received:
    0
    I'm in the process of making space. How can I uninstall a program that isn't on the list and doesn't have its own uninstall program?
     
    shnikes,
    #17
  19. 2005/03/09
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Make sure it's not running and delete all associated files/folders, shortcuts, start menu entries, etc, then run a registry cleaner such as RegSeeker to clean up there.
     
    noahdfear,
    #18
  20. 2005/03/09
    shnikes

    shnikes Inactive Thread Starter

    Joined:
    2005/02/18
    Messages:
    42
    Likes Received:
    0
    I now have 25% free, but the problem's still there.
    I don't know if I want to risk losing data by doing a repair installation, it looks pretty complicated to me. So.. I'll just live with it for now. I guess I learned my lesson not to fool around with registry, even if it does show up on scans.
     
    shnikes,
    #19
  21. 2005/03/10
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    Probably a wise decision as repairs can go wrong, but I suspect that you will not want to live with that problem for too long :)

    So, for future reference ....

    As you have a couple of partitions and have moved all your data to the second partition (you did that?) a clean install of Windows would be your best option - you will need to reinstall all your programs.

    If you have a Recovery CD as opposed to a Windows XP installation CD ignore all that follows. Most Recovery disks format the drive - regardless of the number of partitions you have and everything on the hard drive is lost and the computer is returned the state in which it was originally supplied.

    Before you begin back up a few items to the second partition ....

    Outlook Express

    Export your account details to a folder on D - Tools > Accounts > Export. Once you have re-installed Windows you can import them into OE.

    Export your Address Book to D - Addresses (Menu Bar) > File > Export > Address Book (WAB). Again you can import this back into OE

    Change the default Message Store for OE - Tools > Options > Maintenance > Store Folder and select a location on D - best to make a folder there first. After Windows is reinstalled just point OE to that location

    Internet Explorer

    File > Export > Favourites - to a location on D - you can import them to the new install later.

    File > Export > Cookies - to a location on D - you can import them to the new install later.

    Windows XP

    You cannot uninstall XP as such, unless it was an upgrade over 98/Me and you took the option to save the previous installation. The route is a format and install afresh. As you have 2 partitions/drives the C partition/drive can be safely formatted without touching D partition/drive.

    This assumes that you have a Windows XP CD and not a Recovery disk Many Recovery disks destroy partition information and wipe the entire drive.

    Check in your BIOS that the boot order is set CD/Floppy/HD

    Boot from the Windows CD "“ follow the on screen prompts "¦..

    To set up Windows XP now press ENTER

    Accept the Licence Agreement F8

    Searching for previous versions of Windows

    To continue installing a fresh copy of Windows without repairing press ESC

    Ensure that the drive/partition selected is the one on which XP was set up and press D to delete the selected partition.

    To delete the partition press ENTER

    To delete the partition press L "“ heed the warnings and DOUBLE CHECK before hitting L

    To create a partition in the unpartitioned space press C

    Accept max size and press ENTER

    To set up Windows XP on the selected item (Partition (New Raw)) press ENTER
    Format the partition using the NTFS file system "“ preferred unless you want an install of Win 98 to access data on the drive/partition, if so choose FAT.

    Set up is formatting "¦â€¦

    When format is complete XP will install.

    When complete install your antivirus and firewall before you even think of connecting to the Internet. Update the virus definitions immediately and then go to Windows Updates and download the Critical updates.
     
    PeteC,
    #20
Page 1 of 2
Thread Status:
Not open for further replies.

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...