AVG runs out of System Resources?

[MikeMoss]

Hi

My computer…

Dell XPS. Windows XP Pro. Dual Core 3ghx. 2gig fast ram. Nvidia 7800 GTX video card. Everything clean and spy-ware free. Defragged no Registry Errors, no unnecessary start up items.

Every time I try and run a complete scan of my computer or even drive C using AVG my computer grinds to a halt and runs out of system resources. The display becomes corrupted and some of the type disappears from the menus.

The mouse still works and I can sometimes shut down other times not.

Now here is the weird thing.

I can edit, encode and copy feature length films using Adobe Premiere with no problems.
I do it all the time, so why does it do this just running a virus check?

I can run complex 3D creation software etc. is this a problem with AVG or some kind of configuration thing.

It has done this for quite a while; I never had this problem when I was using McAfee which is a notorious resource hog.

Anyone have any idea?

Mike

 

[MikeMoss]

PS.

I do not run anything else at the same time I am running an AVG scan.

Mike

 

[electronicsfreak]

What all do you have loading in msconfig? Also have you tried removing avg and reinstalling it. As it could be corrupted.

There is a point in wisdom and knowledge that when you reach it, you exceed what is considered possible - Jason Schoon

 

[MikeMoss]

Hi

I'll try uninstalling and reinstalling.

I have very few things starting automatically at startup.
Since I run such memory intensive programs I have kind of eliminated everything I can.

So maybe there is something wrong with the installation.
I did find though that the program will run in Safe Mode without hanging so I don't really know, maybe it does conflict with something.

Anyway it won't hurt to uninstall it and start over to see what happens.

Mike

 

[electronicsfreak]

If you have norton on there it does conflict with it.

There is a point in wisdom and knowledge that when you reach it, you exceed what is considered possible - Jason Schoon

 

[MikeMoss]

Hi

I'm not running any other software for anti virus.
Just AVG and Zone Alarm.

I haven't had time to run a complete test since I reinstalled but as soon as I have time I'll see if it helped.

Mike

 

[MikeMoss]

Hi

I reinstalled and it still does the same thing.
I don't have a clue.

If I only scan the Windows and Documents and Settings folders it will complete but not if I scan the whole drive.

Mike

 

[pechenegs]

How old is the installation? When was the last time you defragged the hard drive!?



Download hijack this from the link below.Please do this. Click here:

http://www.thespykiller.co.uk/files/hijackthis_sfx.exe

to download HijackThis. Click scan and save a logfile, then post it here so
we can take a look at it for you. Don't click fix on anything in hijack this
as most of the files are legitimate.


Member of ASAP Alliance of Security Analysis Professionals

under the name khazars

 

[MikeMoss]

Hi

Installation is recent because they just updated.
The hard drives are defraged ever couple of days.

I run Spybot and use Spyware Blaster and as I said I can encode an entire feature lengh film in Adobe Premiere with out problems but I can never run a complete virus check.

Here is the log file.

Logfile of HijackThis v1.99.1
Scan saved at 4:31:31 PM, on 3/14/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
C:\Program Files\Pure Networks\Network Magic\nmapp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Auslogics\AusLogics BoostSpeed\boostspeed.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\MemTurbo 4\MemTurbo.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
C:\WINDOWS\System32\GEARSec.exe
C:\Program Files\Norton Ghost\Agent\VProSvc.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www6.comcast.net/a/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

http://www.yahoo.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.yahoo.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: IE to GetRight Helper - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe"
O4 - HKLM\..\Run: [nmapp] "C:\Program Files\Pure Networks\Network Magic\nmapp.exe" -autorun -nosplash
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKCU\..\Run: [EPSON Stylus Photo R280 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICKA.EXE /FU "C:\WINDOWS\TEMP\E_S91.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Auslogics BoostSpeed 4] C:\Program Files\Auslogics\AusLogics BoostSpeed\boostspeed.exe
O4 - Startup: MemTurbo.lnk = C:\Program Files\MemTurbo 4\MemTurbo.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: Post Image to Blog - res://C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll/5003
O8 - Extra context menu item: Tag This Image - res://C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll/5002
O8 - Extra context menu item: Transload Image to ImageShack - res://C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll/5004
O8 - Extra context menu item: Upload All Images to ImageShack - res://C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll/5000
O8 - Extra context menu item: Upload Image to ImageShack - res://C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll/5001
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} -

https://support.microsoft.com/OAS/ActiveX/MSDcode.cab

O16 - DPF: {2DFF31F9-7893-4922-AF66-C9A1EB4EBB31} (Rhapsody Player Engine) -

http://software-dl.real.com/093b5ce.../mrkt/rhapx/RhapsodyPlayerEngine_Inst_Win.cab

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) -

http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.2.100.cab

O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) -

http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -

http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1194729998562

O16 - DPF: {6932D140-ABC4-4073-A44C-D4A541665E35} (ImageShack Toolbar) -

http://toolbar.imageshack.us/toolbar/ImageShackToolbar.cab

O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) -

http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cab

O18 - Protocol: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp3.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: LBTWlgn - C:\WINDOWS\
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\windows\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Unknown owner - (no file)
O23 - Service: Pure Networks Net2Go Service (nmraapache) - Unknown owner - C:\Program Files\Pure Networks\Network Magic\WebServer\bin\nmraapache.exe" -k runservice (file missing)
O23 - Service: Pure Networks Platform Service (nmservice) - Pure Networks, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: RoxMediaDB - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
O23 - Service: Roxio Hard Drive Watcher (RoxWatch) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

 

[pechenegs]

yhe log is clean! Perhaps try a few scans to make sure, if clean it maybe a hardware issue somewhere, are you getting any errors? blue screens?


NOTE: If you have downloaded ComboFix previously please delete that
version and download it again!



Download ComboFix from
http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe"]Here[/URL]
or
Here
to your Desktop.

Reboot to Safe mode:

Restart your computer and begin tapping the F8 key on your keyboard just
before Windows starts to load. If done right a Windows Advanced Options menu
will appear. Select the Safe Mode option and press Enter.

Perform the following actions in Safe Mode.

• Double click combofix.exe and follow the prompts.
• When finished, it shall produce a log for you. Post that log and a
  HiJackthis log in your next reply

Note: Do not mouseclick combofix's window while its
running. That may cause it to stall






Download Superantispyware (SAS):

http://www.superantispyware.com/supe....html?rid=3132

Once downloaded and installed update the defintions
and then run a full system scan quarantine what it finds!


* Double-click SUPERAntiSypware.exe and use the default settings for
installation.
* An icon will be created on your desktop. Double-click that icon to launch
the program.
* If asked to update the program definitions, click "Yes". If not, update
the definitions before scanning by selecting "Check for Updates". (If you
encounter any problems while downloading the updates, manually download and
unzip them from here.)

http://www.superantispyware.com/definitions.html

* Under "Configuration and Preferences", click the Preferences button.
* Click the Scanning Control tab.
* Under Scanner Options make sure the following are checked (leave all
others unchecked):
o Close browsers before scanning.
o Scan for tracking cookies.
o Terminate memory threats before quarantining.
* Click the "Close" button to leave the control center screen.
* Back on the main screen, under "Scan for Harmful Software" click Scan your
computer.
* On the left, make sure you check C:\Fixed Drive.
* On the right, under "Complete Scan", choose Perform Complete Scan.
* Click "Next" to start the scan. Please be patient while it scans your
computer.
* After the scan is complete, a Scan Summary box will appear with
potentially harmful items that were detected. Click "OK".
* Make sure everything has a checkmark next to it and click "Next".
* A notification will appear that "Quarantine and Removal is Complete".
Click "OK" and then click the "Finish" button to return to the main menu.
* If asked if you want to reboot, click "Yes".
* To retrieve the removal information after reboot, launch SUPERAntispyware
again.
o Click Preferences, then click the Statistics/Logs tab.
o Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
o If there are several logs, click the current dated log and press View log.
A text file will open in your default text editor.
o Please copy and paste the Scan Log results in your next reply.
* Click Close to exit the program.


* Download Dr.Web CureIt to the desktop:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

* Doubleclick the drweb-cureit.exe file and Allow to run the express scan
* This will scan the files currently running in memory and when something is
found,
click the yes button when it asks you if you want to cure it. This is only a
short scan.
* Once the short scan has finished, Click Options > Change settings
* Choose the "Scan"-tab, remove the mark at "Heuristic analysis".
* Back at the main window, mark the drives that you want to scan.
* Select all drives. A red dot shows which drives have been chosen.
* Click the green arrow at the right, and the scan will start.
* Click 'Yes to all' if it asks if you want to cure/move the file.
* When the scan has finished, look if you can click next icon next to the
files found: IPB Image
* If so, click it and then click the next icon right below and select Move
incurable as you'll see in next image:
IPB Image
This will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it
can't be cured. (this in case if we need samples)
* After selecting, in the Dr.Web CureIt menu on top, click file and choose
save report list
* Save the report to your desktop. The report will be called DrWeb.csv
* Close Dr.Web Cureit.
* Reboot your computer!! Because it could be possible that files in use will
be moved/deleted during reboot.




Post a new hijack this, the dr web scan log, the combo, and the superantispyware log!




Member of ASAP Alliance of Security Analysis Professionals

under the name khazars

 

[MikeMoss]

Hi

Thanks for the help.

Mike

 

[MikeThorne]

Hi pechenegs

Well I posted all the stuff that you asked for but for some reason the message and one I posted before it saying that I would be posting the information vanished and now I can't log in to this site anymore.

I have e-mailed them several times but don't receive any response.

I have no clue.

I will only ad that when I tried to run Dr.Web it did the same thing as AVG and I received a message that said...

"Not enough timers available."

The other tests all came up clean as far as spy ware or viruses were concerned.

I'm using a friend’s account to post this message.

Thanks again for the help.

Mike

 

[pechenegs]

Ihmm, can you post a hijack this log, is the computer running any better now after the scans?

Member of ASAP Alliance of Security Analysis Professionals

under the name khazars

 

[MikeThorne]

Hi again

Here is the new Hijack This log.

My computer seems to be running fine, I think I removed a lot or all of my cookies when I was running all the stuff but the only spy ware I found was a couple of things I was aware of like GameSpot. Maybe something I removed is why I can't log in here with my own account. That doesn't explain why my posts disappeared though.

I haven't had time to try running a complete scan using AVG but I will do it tomorrow in both regular and Safe Mode.

As I said I had exactly the same result running Dr.web on the full scan. The original scan went through before I turned off "Heuristic analysis". This scan didn't find anything and came up completely clean.

I tried to find out what "Not Enough Timers Avaiable" means but really didn't find anything except someone else describing the same thing that I'm seeing.


Here is the HiJack This log...This file was made after running all the other programs...


Logfile of HijackThis v1.99.1
Scan saved at 12:23:15 AM, on 3/19/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
C:\Program Files\Pure Networks\Network Magic\nmapp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Auslogics\AusLogics BoostSpeed\boostspeed.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\MemTurbo 4\MemTurbo.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
C:\WINDOWS\System32\GEARSec.exe
C:\Program Files\Norton Ghost\Agent\VProSvc.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =

http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.comcast.net/a/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: IE to GetRight Helper - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe"
O4 - HKLM\..\Run: [nmapp] "C:\Program Files\Pure Networks\Network Magic\nmapp.exe" -autorun -nosplash
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKCU\..\Run: [EPSON Stylus Photo R280 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICKA.EXE /FU "C:\WINDOWS\TEMP\E_S91.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Auslogics BoostSpeed 4] C:\Program Files\Auslogics\AusLogics BoostSpeed\boostspeed.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: MemTurbo.lnk = C:\Program Files\MemTurbo 4\MemTurbo.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} -

https://support.microsoft.com/OAS/ActiveX/MSDcode.cab

O16 - DPF: {2DFF31F9-7893-4922-AF66-C9A1EB4EBB31} (Rhapsody Player Engine) -

http://software-dl.real.com/093b5ce.../mrkt/rhapx/RhapsodyPlayerEngine_Inst_Win.cab

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) -

http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.2.100.cab

O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) -

http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -

http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1194729998562

O16 - DPF: {6932D140-ABC4-4073-A44C-D4A541665E35} (ImageShack Toolbar) -

http://toolbar.imageshack.us/toolbar/ImageShackToolbar.cab

O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) -

http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cab

O18 - Protocol: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp3.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: LBTWlgn - C:\WINDOWS\
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\windows\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Unknown owner - (no file)
O23 - Service: Pure Networks Net2Go Service (nmraapache) - Unknown owner - C:\Program Files\Pure Networks\Network Magic\WebServer\bin\nmraapache.exe" -k runservice (file missing)
O23 - Service: Pure Networks Platform Service (nmservice) - Pure Networks, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: RoxMediaDB - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
O23 - Service: Roxio Hard Drive Watcher (RoxWatch) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Mike

 

[MikeThorne]

Hi again...

Here is an error report that was automatically e-mailed to
BootSpeed I just discovered it going though my sent mail.

Note the last two entries in the first paragraph.
--------------------------------------------------------------

Please send this e-mail containing the bug report to the Support Team to help fix this issue.

date/time : 2008-03-15, 12:33:19, 625ms
operating system : Windows XP Media Center Service Pack 2 build 2600
system language : English
system up time : 1 hour 10 minutes
program up time : 1 hour 9 minutes
physical memory : 1190/2045 MB (free/total)
free disk space : (C 78.32 GB
display mode : 0x0, 0 bit
process id : $20c
allocated memory : 3.58 MB
executable : boostspeed.exe
current module : madExcept_.bpl
exec. date/time : 2008-03-07 12:04
version : 1.0.0.2
compiled with : Delphi 7
madExcept version : 3.0e
callstack crc : $bb44d6b1, $24f19869, $24f19869
exception number : 1
exception class : EOutOfResources
exception message : Not enough timers available.



main thread ($3f8):
0046e951 +069 vcl70.bpl Extctrls TTimer.UpdateTimer
0046e97c +008 vcl70.bpl Extctrls TTimer.SetEnabled
0040a4e9 +11d boostspeed.exe ufrmMain 531 +22 TfrmMain.TimerRequestTimer
0046e9bb +00f vcl70.bpl Extctrls TTimer.Timer
0046e89f +02b vcl70.bpl Extctrls TTimer.WndProc
7e4196c2 +00a user32.dll DispatchMessageA
004f4dab +083 vcl70.bpl Forms TApplication.ProcessMessage
004f4de2 +00a vcl70.bpl Forms TApplication.HandleMessage
004f5002 +096 vcl70.bpl Forms TApplication.Run
0040c805 +171 boostspeed.exe BoostSpeed 66 +34 initialization

modules:
00400000 boostspeed.exe 1.0.0.2 C:\Program Files\Auslogics\AusLogics BoostSpeed
00450000 vcl70.bpl 7.0.4.453 C:\Program Files\Auslogics\AusLogics BoostSpeed
01f00000 Localizer.dll 1.1.2.30 C:\Program Files\Auslogics\AusLogics BoostSpeed
01f10000 helper.dll 3.1.4.218 C:\Program Files\Auslogics\AusLogics BoostSpeed
01f60000 settings.dll 1.0.0.41 C:\Program Files\Auslogics\AusLogics BoostSpeed
01f80000 Normaliz.dll 6.0.5441.0 C:\WINDOWS\system32
40000000 rtl70.bpl 7.0.4.453 C:\Program Files\Auslogics\AusLogics BoostSpeed
42990000 iertutil.dll 7.0.6000.16608 C:\WINDOWS\system32
42c10000 wininet.dll 7.0.6000.16608 C:\WINDOWS\system32
50000000 AxPackage10.bpl 1.0.1.329 C:\Program Files\Auslogics\AusLogics BoostSpeed
57000000 madBasic_.bpl C:\Program Files\Auslogics\AusLogics BoostSpeed
57800000 madDisAsm_.bpl C:\Program Files\Auslogics\AusLogics BoostSpeed
59800000 madExcept_.bpl C:\Program Files\Auslogics\AusLogics BoostSpeed
5ad70000 uxtheme.dll 6.0.2900.2180 C:\WINDOWS\system32
5b860000 NETAPI32.dll 5.1.2600.2976 C:\WINDOWS\system32
71aa0000 WS2HELP.dll 5.1.2600.2180 C:\WINDOWS\system32
71ab0000 WS2_32.dll 5.1.2600.2180 C:\WINDOWS\system32
71ad0000 wsock32.dll 5.1.2600.2180 C:\WINDOWS\system32
71b20000 mpr.dll 5.1.2600.2180 C:\WINDOWS\system32
71bf0000 SAMLIB.dll 5.1.2600.2180 C:\WINDOWS\system32
73000000 winspool.drv 5.1.2600.2180 C:\WINDOWS\system32
74720000 MSCTF.dll 5.1.2600.2180 C:\WINDOWS\system32
755c0000 msctfime.ime 5.1.2600.2180 C:\WINDOWS\system32
76380000 msimg32.dll 5.1.2600.2180 C:\WINDOWS\system32
76390000 IMM32.DLL 5.1.2600.2180 C:\WINDOWS\system32
763b0000 comdlg32.dll 6.0.2900.2180 C:\WINDOWS\system32
76780000 SHFolder.dll 6.0.2900.2180 C:\WINDOWS\system32
76b20000 ATL.DLL 3.5.2284.0 C:\WINDOWS\system32
76b40000 winmm.dll 5.1.2600.2180 C:\WINDOWS\system32
76d40000 MPRAPI.dll 5.1.2600.2180 C:\WINDOWS\system32
76d60000 IPHLPAPI.DLL 5.1.2600.2912 C:\WINDOWS\system32
76e10000 adsldpc.dll 5.1.2600.2180 C:\WINDOWS\system32
76e80000 rtutils.dll 5.1.2600.2180 C:\WINDOWS\system32
76f60000 WLDAP32.dll 5.1.2600.2180 C:\WINDOWS\system32
77120000 oleaut32.dll 5.1.2600.3266 C:\WINDOWS\system32
773d0000 comctl32.dll C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03
774e0000 ole32.dll 5.1.2600.2726 C:\WINDOWS\system32
77920000 setupapi.dll 5.1.2600.2180 C:\WINDOWS\system32
77b40000 apphelp.dll 5.1.2600.2180 C:\WINDOWS\system32
77c00000 version.dll 5.1.2600.2180 C:\WINDOWS\system32
77c10000 msvcrt.dll 7.0.2600.2180 C:\WINDOWS\system32
77cc0000 ACTIVEDS.dll 5.1.2600.2180 C:\WINDOWS\system32
77dd0000 advapi32.dll 5.1.2600.2180 C:\WINDOWS\system32
77e70000 RPCRT4.dll 5.1.2600.3173 C:\WINDOWS\system32
77f10000 GDI32.dll 5.1.2600.3159 C:\WINDOWS\system32
77f60000 SHLWAPI.dll 6.0.2900.3199 C:\WINDOWS\system32
77fe0000 Secur32.dll 5.1.2600.2180 C:\WINDOWS\system32
7c800000 kernel32.dll 5.1.2600.3119 C:\WINDOWS\system32
7c900000 ntdll.dll 5.1.2600.2180 C:\WINDOWS\system32
7c9c0000 SHELL32.dll 6.0.2900.3241 C:\WINDOWS\system32
7df70000 oledlg.dll 5.1.2600.3016 C:\WINDOWS\system32
7e410000 user32.dll 5.1.2600.3099 C:\WINDOWS\system32

processes:
000 Idle
004 System normal
3d0 smss.exe normal
408 csrss.exe
428 winlogon.exe high
454 services.exe normal
460 lsass.exe normal
500 svchost.exe normal
540 svchost.exe
5a0 svchost.exe normal
600 svchost.exe
658 svchost.exe
664 vsmon.exe normal
150 spoolsv.exe normal
25c explorer.exe below normal
2e8 zlclient.exe below normal
22c rundll32.exe normal
30c avgcc.exe normal
3c0 nmctxth.exe normal
3c8 nmapp.exe normal
3e0 ctfmon.exe normal
404 TeaTimer.exe idle
20c BoostSpeed.exe normal
4a4 MemTurbo.exe normal
5d8 avgamsvr.exe normal
698 avgupsvc.exe normal
6e8 avgemc.exe normal
708 mDNSResponder.exe normal
70c CCSETMGR.EXE normal
1a8 CTSVCCDA.EXE normal
23c E_S40RP7.EXE normal
2a8 gearsec.exe normal
2b8 VProSvc.exe normal
7cc nTuneService.exe normal
8cc nvsvc32.exe normal
8e8 svchost.exe normal
9ac symlcsvc.exe normal
a08 nmsrvc.exe normal
b4c alg.exe
19c svchost.exe normal
b28 SUPERAntiSpyware.exe below normal
b98 drweb-cureit.exe normal
730 _start.exe below normal
928 setup.exe above normal

cpu registers:
eax = 00ac7d18
ebx = 00a9aef0
ecx = 00000002
edx = 0046e951
esi = 0000012c
edi = 0013fe84
eip = 0046e951
esp = 0013fd80
ebp = 0013fdc8

stack dump:
0013fd80 51 e9 46 00 de fa ed 0e - 01 00 00 00 07 00 00 00 Q.F.............
0013fd90 94 fd 13 00 51 e9 46 00 - 18 7d ac 00 f0 ae a9 00 ....Q.F..}......
0013fda0 2c 01 00 00 84 fe 13 00 - c8 fd 13 00 b0 fd 13 00 ,...............
0013fdb0 e8 fd 13 00 9c 5f 00 40 - c8 fd 13 00 00 00 00 00 ....._.@........
0013fdc0 88 ba ad 00 00 00 00 00 - 04 fe 13 00 81 e9 46 00 ..............F.
0013fdd0 ee a4 40 00 ac e9 46 00 - f0 ae a9 00 be e9 46 00 ..@...F.......F.
0013fde0 0c fe 13 00 a4 e8 46 00 - a0 fe 13 00 bc 5d 00 40 ......F......].@
0013fdf0 04 fe 13 00 84 fe 13 00 - 87 0f ef 01 00 00 00 00 ................
0013fe00 f0 ae a9 00 1c fe 13 00 - be d0 03 40 13 01 00 00 ...........@....
0013fe10 01 00 00 00 00 00 00 00 - 00 00 00 00 48 fe 13 00 ............H...
0013fe20 34 87 41 7e 78 01 01 00 - 13 01 00 00 01 00 00 00 4.A~x...........
0013fe30 00 00 00 00 87 0f ef 01 - cd ab ba dc 00 00 00 00 ................
0013fe40 84 fe 13 00 87 0f ef 01 - b0 fe 13 00 16 88 41 7e ..............A~
0013fe50 87 0f ef 01 78 01 01 00 - 13 01 00 00 01 00 00 00 ....x...........
0013fe60 00 00 00 00 48 ff 13 00 - 40 ff 13 00 48 cd 7b 00 ....H...@...H.{.
0013fe70 14 00 00 00 01 00 00 00 - 00 00 00 00 00 00 00 00 ................
0013fe80 10 00 00 00 00 00 00 00 - 30 00 00 00 00 00 00 00 ........0.......
0013fe90 00 00 00 00 00 00 00 00 - 64 fe 13 00 78 01 01 00 ........d...x...
0013fea0 00 ff 13 00 57 04 44 7e - 30 88 41 7e 00 00 00 00 ....W.D~0.A~....
0013feb0 10 ff 13 00 cd 89 41 7e - 00 00 00 00 87 0f ef 01 ......A~........

disassembling:
[...]
0040a4d4 529 mov dl, 1
0040a4d6 mov eax, [ebx+$300]
0040a4dc call -$7f3d ($4025a4) ; Extctrls.TTimer.SetEnabled (vcl70.bpl)
0040a4e1 531 mov dl, 1
0040a4e3 mov eax, [ebx+$344]
0040a4e9 > call -$7f4a ($4025a4) ; Extctrls.TTimer.SetEnabled (vcl70.bpl)
0040a4ee 532 pop esi
0040a4ef pop ebx
0040a4f0 ret

 

[pechenegs]

I meant, how old is the installation of windows?

You have ghost, why not use that to restore your image, or try system restore to roll back to before this started. i would take AVG off and leave it and try Avir instead see if that helps!

http://www.avira.com

Member of ASAP Alliance of Security Analysis Professionals

under the name khazars

 

[MikeThorne]

Hi

The problem with Ghost is that I have had this problem for a long time.
I originally posted about this months ago and never found an answer.

Any recent Ghost or Windows Restore image I have includes the problem and too many things have changed to go back before the problem started.

I originally used McAfee Anti-virus software. This problem started sometime after I switched.

I will check out Avir I am not familiar with it and see what happens if I dump AVG.

Thanks for the help...

Mike

 

[pechenegs]

if the installation of Xp is over a year or two you'd be better and quicker to just reformat with a clean install of XP!

Member of ASAP Alliance of Security Analysis Professionals

under the name khazars

 

[MikeThorne]

Hi

I just ran a complete scan using Avira and it completed successfully. No problems found.

Starting from scratch is just too much to resolve this.

I had hoped to find a solution and then make a new Ghost image file that was clear of the problem.

I'll stick with Avira for now and in the fall it will be time to replace my computer again (every 3 years) and I will have to start from scratch anyway.

With all my Adobe software that has to be reregistered and reconfigured for color matching and everything I only do it if I absolutely have to. That's why I have Ghost; to avoid having to redo everything.

I have a brand new never used copy of Windows XP Professional that is just waiting to be installed on my new computer when I get it, so I can avoid the Vista hassles.

I still don’t know if the problem is caused by AVG, some kind of configuration problem, or hardware but I’ll just have to live with it if it shows up again.

I have to say that this Dell XPS (long time Dell user) computer has been the most unstable that I have ever had and I have never been able to pin point the cause of the problem.

It crashed the first time I booted it up and I spent 7 hours on the phone before it was up and running half the time typing in code that I was being given by some guy with an Indian accent. Except for the virus scan thing it actually seems better right now then it has been in a long time (haven’t seen a blue screen in over a week) and I will make a new Ghost image file with the Avira Installation as soon as I get off here.

Thanks again for the help, I posted this problem on several forums over several months and you are the only one who actually responded.

Mike

 

[pechenegs]

you cna always make another partition and instlal Xp on that and then transfer your files over from the current install of Xp, why waste money on buying anew computer just to avoid a reinstall?

If you do but a new computer, please make a image of it once you have all the software installed or make one before you put the software on! Nowadays, most new computers come with a software program preinstalled which bugs you to make a back-up image of the installation of XP/Vista when you first buy the computer.

It's best to make this disc and get it out of the way and keep it safe as if you don't and have the problems you have had without the full XP disc many would have been up the river without a paddle!

The issue may have been caused by a bad driver or driver conflict somewhere, but didn't you have McAfee on the machine before putting AVG on it?

Member of ASAP Alliance of Security Analysis Professionals

under the name khazars