[unbodi]

Hello.

I dont know why, but from yesterday i'm having this strage issue in my windows.everytime i restart my computer its getting into the chkdsk (error checking) sceen(you know, the blue one that checks for errors) and it just says : Cannot open volume for direct accsec''. and than it just comes out, and keep with the windows loading normally. i dont know what to do =(



Please help,
Unbodi.

*and btw, someone told me to write those commands: regsvr32 jscript, regsvr32 vbscript, regsvr32 /i mshtml


but now its just worse.everytime i open my icq or some other internet application its trying to give me something to download..(like if i'm logging to icq its giving me those icq bannars or something like that.)

[Advertisements]

Hi unbodi

Click Start, then Run, type cmd, and click "Ok". In the command window that opens, type fsutil dirty query c: at the prompt and press "Enter".

Does the result of this indicate the drive is "Dirty"?

wannabe1

[wannabe1]

Hi unbodi

Click Start, then Run, type cmd, and click "Ok". In the command window that opens, type fsutil dirty query c: at the prompt and press "Enter".

Does the result of this indicate the drive is "Dirty"?

wannabe1

[unbodi]

Hello.

I dont know why, but from yesterday i'm having this strage issue in my windows.everytime i restart my computer its getting into the chkdsk (error checking) sceen(you know, the blue one that checks for errors) and it just says : Cannot open volume for direct accsec''. and than it just comes out, and keep with the windows loading normally. i dont know what to do =(
Please help,
Unbodi.

*and btw, someone told me to write those commands: regsvr32 jscript, regsvr32 vbscript, regsvr32 /i mshtml
but now its just worse.everytime i open my icq or some other internet application its trying to give me something to download..(like if i'm logging to icq its giving me those icq bannars or something like that.)

Hello and thx for the reply.

whan i done that, it opend a window and closed it off after a second.

good or bad?

[Retired Tech]

Can you try the same thing with start, all programmes, accessories, command prompt

[unbodi]

Can you try the same thing with start, all programmes, accessories, command prompt

Ok it says that:

''Volume - c: is Dirty''


thats bad?and what should i do next?

thanks

[wannabe1]

Hi unbodi...

This is called a "Dirty Bit". We need to unset that Dirty Bit.

• If you have Spyware Doctor installed, uninstall it.
• If you have ZoneAlarm installed, open it, click the "Overview" tab, then select "Preferences", and UNcheck the "Protect ZA Client" check box.

Click Start, then Run, type cmd in the Open box and click "Ok". At the prompt in the Command window, type the following commands, pressing "Enter" after each one: (Please note the spaces in the following commands.)

• chkntfs /d ..... (This will reset autocheck options to default)
• chkntfs /c C: ..... (This will allow checking drive C:)
• fsutil dirty query c: ..... (This queries the drive and will most likely tell you that it is dirty)
• chkntfs /x c: ..... (The x switch tells Windows to NOT check the specified drive on the next boot)

At this point, restart your computer, it will not do a chkdsk and will boot directly to Windows.

This next step is important as this is where the Dirty Bit will be unset.
Click Start, then Run, type cmd in the Open box and click "Ok". At the command prompt, type the following, pressing "Enter" after each one: (Again, note the spaces.)

• chkdsk /f /r c: ..... (To manually run a full chkdsk operation)
• Y ..... (To accept having it run on the next boot)

This should take you through 5 stages of the scan and will unset that Dirty Bit. Be patient...this is a very thorough check and will take quite a while.

Finally, when the chkdsk operation has completed, type fsutil dirty query c:, press "Enter", and Windows will confirm that the Dirty Bit is not set on that drive.

Now reboot again and see if chkdsk still runs on bootup.

wannabe1

[unbodi]

Hi unbodi...

This is called a "Dirty Bit". We need to unset that Dirty Bit.[list]
[*]If you have Spyware Doctor installed, uninstall it.

wannabe1

Hello wannbe1.

I think that spydoctor was my problem all along, because after i uninstalled it, i did a restart to my comp and chkdsk ran again.this time it ran normally and did fix alot of errors.after the scan it restarted my comp again, got into chkdsk and writted (from what i remmeber) : ''driver c: is clean''.

than it loaded the windows and i checked what it says about the dirty . well it says now: ''Volume c: is NOT dirty''.


so i got some questions to ask you:

1. If my driver is not ''dirty'' anymore, should i still make the other stuff you told me after the spydoctor part?

2. Spydoctor was one of my best anti spywarers that i used.is there anyway to install it again without problems?


and thanks for the great help!

[wannabe1]

Hi unbodi...

You lucked out. Usually the dirty bit is a little tougher to unset than that, but if the drive query comes back clean, you should be good to go.

The Spyware Doctor application affects different systems in different ways. Just why that is so, I don't know. The same is true of ZoneAlarm. I would look into an alternative for Spyware Doctor such as Spyware Blaster or Windows Defender Beta...preferrably the latter (Defender)...it's from Microsoft and shouldn't have any adverse effects on your system.

Glad to help!

wannabe1

[unbodi]

Ok just wanted to say thanks again.


but i just got another little problem that i need help with.someone that i know, told me that to solve the last problem, i should go to start- run- and write :
regsvr32 jscript, regsvr32 vbscript, regsvr32 /i mshtml

Well it didnt work(and if you can please tell me what it does too) and now everytime i log into an internet application, like icq or steam it asking me to download stuff.even whan i open internet explorer or babylon.

pictures:
http://img210.images...untitled6ym.jpg
http://img210.images...titled21oc1.jpg

its very,very annoying, because its just keep coming back again and again after i close what ever trigger it.

anyway to help?

[wannabe1]

regsvr32 jscript registers java script scripting
regsvr32 vbscript registers visual basic scripting
regsvr32 /i mshtml registers an IE html editing application

These are all ok.

The screenshots all show htm files, so I'm assuming you've lost a file association somewhere along the way. Could you get me a screenshot of your file association window showing the htm and html portion?

Open Control Panel and double click Folder Options. Click the File Type tab and scroll down the list to HTM and select it...grab a screenshot and post it for me.

Edited by wannabe1, 12 April 2006 - 06:17 PM.

[unbodi]

regsvr32 jscript registers java script scripting
regsvr32 vbscript registers visual basic scripting
regsvr32 /i mshtml registers an IE html editing application

These are all ok.

The screenshots all show htm files, so I'm assuming you've lost a file association somewhere along the way. Could you get me a screenshot of your file association window showing the htm and html portion?

Open Control Panel and double click Folder Options. Click the File Type tab and scroll down the list to HTM and select it...grab a screenshot and post it for me.

Hmmm, i'm not sure but i hope that what youve asked for:
http://img124.images...ntitled38hq.jpg

if not, tell me again and i'll try to find the right place.

[wannabe1]

File associations look fine. The files it wants to update are ok. Two are webpages...one for ICQ and one for a gameing site. If you play games on that site, I'd say it's ok to accept them. That should eliminate the warning windows.

[unbodi]

File associations look fine. The files it wants to update are ok. Two are webpages...one for ICQ and one for a gameing site. If you play games on that site, I'd say it's ok to accept them. That should eliminate the warning windows.

Well, those stuff that every progrem whants me to downlaod just keep popping.if i do ''open'' or even ''save as'', its just giving me more and more.

Other solusions?

[wannabe1]

Can you attach a HiJackThis log to your next post for me. You can download HiJackThis from the link in my signature.

[unbodi]

Yes, ofc.

Here is the log:


Logfile of HijackThis v1.99.1
Scan saved at 03:59:07, on 13/04/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\brsvc01a.exe
C:\WINDOWS\System32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\WINDOWS\system32\Brmfrmps.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\ECI Telecoms\ECI USB ADSL\DSLMON.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\Program Files\Steam\steam.exe
C:\Program Files\The All-Seeing Eye\eye.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\TAL 1\Desktop\tal\תוכנות\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gamer.co.il/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - blank (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [kis] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: DSLMON.lnk = C:\Program Files\ECI Telecoms\ECI USB ADSL\DSLMON.exe
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Add to Kaspersky Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\\ie_banner_deny.htm
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE12\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: הורד באמצעות פלאש-גט - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: הורד הכל באמצעות פלאש-גט - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE12\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1133895744905
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1143641890420
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcaf...,23/mcgdmgr.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{00F968C9-D26D-4598-B192-353CFC01F9E7}: NameServer = 212.143.212.143 194.90.1.5
O17 - HKLM\System\CS1\Services\Tcpip\..\{00F968C9-D26D-4598-B192-353CFC01F9E7}: NameServer = 212.143.212.143 194.90.1.5
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing)
O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Unknown owner - C:\WINDOWS\system32\Brmfrmps.exe" -service (file missing)
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\System32\brsvc01a.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe