[Jerry23]

I forgot one item - don't know if it is a problem or not.

To the left of my system tray, there are 2 icons I have never seen before. One is a "?". The second is an icon with "restore" on the top & "options" on the bottom. I do not remember seeing these yesterday after I updated to IE8 I am not comfortable with clicking them to see what they do.


Jerry

[Advertisements]

Hey Jerry,

I apologize for the short reply here, but I am just about to step out for a bit.

What I meant was that I think we should still run the Extended Test within the WD Data Lifeguard tools. The green check you are witnessing does not indicate that the Extended Test has already been past; only that the SMART status is still good on the drive. Only by running the extended test can we be certain that there are no problematic bad sectors prior to any upgrades being installed.

Let me know the results when you finish with that. At that point we can examine those system tray icons, software running on your computer that might be causing problems (I can do this since you are no longer infected), and other possible issues.

~os

Edited by othersteve, 09 December 2009 - 03:02 PM.

[othersteve]

Hey Jerry,

I apologize for the short reply here, but I am just about to step out for a bit.

What I meant was that I think we should still run the Extended Test within the WD Data Lifeguard tools. The green check you are witnessing does not indicate that the Extended Test has already been past; only that the SMART status is still good on the drive. Only by running the extended test can we be certain that there are no problematic bad sectors prior to any upgrades being installed.

Let me know the results when you finish with that. At that point we can examine those system tray icons, software running on your computer that might be causing problems (I can do this since you are no longer infected), and other possible issues.

~os

Edited by othersteve, 09 December 2009 - 03:02 PM.

[Jerry23]

Hi OS,

I'm pretty sure I already ran & passed the Extended test last night. It took ~1 hr 15 min to run. Did you catch this:


>>>>>>Edit: Here we go: http://screencast.com/t/OGJmNjdmN

http://screencast.com/t/NDZhYmMzNDQt -- Couldn't quite get all the results in 1 pic.<<<<<

Regards,

Jerry

Edited by Jerry23, 09 December 2009 - 03:53 PM.

[othersteve]

Hey Jerry,

OH! I'm sorry; I thought that was only pertaining to the SMART data. My mistake.

So everything is running better now?

If you don't mind, let's do an Autoruns scan next to see what's loading.

1) Please download Autoruns from Microsoft.
2) Run Autoruns.
3) Click File > Save... > Save as type: Text (*.txt).
4) Attach the saved text file to your next reply for analysis.

~os

[Jerry23]

Hi OS,

It is running quite well. The only glitch is the occassional anomoly with the usage of the IE forward/back buttons - usually in the Yahoo Message boards - I described in a recent post above.

Here is the AutoRuns Txt file. I did not know how to attach it, so I pasted it. Sorry.

Regards,

Jerry






"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" "" "" ""
+ "AVP" "Kaspersky Anti-Virus" "Kaspersky Lab" "c:\program files\kaspersky lab\kaspersky internet security 2010\avp.exe"
+ "CanonMyPrinter" "Canon My Printer" "CANON INC." "c:\program files\canon\myprinter\bjmyprt.exe"
+ "Motive SmartBridge" "Motive SmartBridge" "Motive, Inc." "c:\program files\sbc self support tool\smartbridge\motivesb.exe"
+ "NVMixerTray" "NVIDIA nForce Mixer Tray Application" "NVIDIA Corporation" "c:\program files\nvidia corporation\nvmixer\nvmixertray.exe"
+ "QuickTime Task" "QuickTime Task" "Apple Inc." "c:\program files\quicktime\qttask.exe"
+ "SoundMan" "Realtek Sound Manager" "Realtek Semiconductor Corp." "c:\windows\soundman.exe"
+ "SunJavaUpdateSched" "Java™ Platform SE binary" "Sun Microsystems, Inc." "c:\program files\java\jre6\bin\jusched.exe"
+ "TkBellExe" "RealNetworks Scheduler" "RealNetworks, Inc." "c:\program files\common files\real\update_ob\realsched.exe"
"C:\Documents and Settings\All Users\Start Menu\Programs\Startup" "" "" ""
+ "AT&T Self Support Tool.lnk" "Motive Chorus Command Line Interface" "Motive Communications, Inc." "c:\program files\sbc self support tool\bin\matcli.exe"
+ "Microsoft Office Fast Start.lnk" "" "" "h:\msoffice_w95\office\fastboot.exe"
"HKCU\Software\Microsoft\Windows\CurrentVersion\Run" "" "" ""
+ "Jing" "Jing" "TechSmith Corporation" "e:\jing - screen capture & share\installation\jing.exe"
+ "SpybotSD TeaTimer" "System settings protector" "Safer-Networking Ltd." "e:\spybot-search & destroy\install\spybot - search & destroy\teatimer.exe"
+ "Uniblue RegistryBooster 2" "" "" "File not found: E:\REG BOOST\RegistryBooster 2\RegistryBooster.exe /S"
"HKLM\SOFTWARE\Classes\Protocols\Handler" "" "" ""
+ "x-atng" "Fidelity Active Trader Pro atngprot Module" "Fidelity Investments" "c:\program files\fidelity investments\fidelity active trader\system\atngprot.dll"
"HKCU\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components" "" "" ""
+ "0" "" "" "File not found: About:Home"
"HKLM\Software\Classes\*\ShellEx\ContextMenuHandlers" "" "" ""
+ "Kaspersky Anti-Virus" "Windows Shell Extension" "Kaspersky Lab" "c:\program files\kaspersky lab\kaspersky internet security 2010\shellex.dll"
"HKLM\Software\Classes\AllFileSystemObjects\ShellEx\ContextMenuHandlers" "" "" ""
+ "MBAMShlExt" "Malwarebytes' Anti-Malware" "Malwarebytes Corporation" "e:\malwarebytes2\malwarebytes' anti-malware\mbamext.dll"
"HKLM\Software\Classes\Folder\Shellex\ColumnHandlers" "" "" ""
+ "PXCInfoShlExt Class" "PDF-XChange Shell Extention" "Tracker Software Products Ltd." "e:\pdf-exchange viewer\tracker software\shell extensions\xcshinfo.dll"
+ "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" "" "Sun Microsystems, Inc." "c:\program files\openoffice.org 3\basis\program\shlxthdl\shlxthdl.dll"
"HKLM\Software\Classes\Folder\ShellEx\ContextMenuHandlers" "" "" ""
+ "Kaspersky Anti-Virus" "Windows Shell Extension" "Kaspersky Lab" "c:\program files\kaspersky lab\kaspersky internet security 2010\shellex.dll"
+ "MBAMShlExt" "Malwarebytes' Anti-Malware" "Malwarebytes Corporation" "e:\malwarebytes2\malwarebytes' anti-malware\mbamext.dll"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved" "" "" ""
+ "Display Panning CPL Extension" "" "" "File not found: deskpan.dll"
+ "HyperTerminal Icon Ext" "HyperTerminal Applet Library" "Hilgraeve, Inc." "c:\windows\system32\hticons.dll"
+ "OpenOffice.org Column Handler" "" "Sun Microsystems, Inc." "c:\program files\openoffice.org 3\basis\program\shlxthdl\shlxthdl.dll"
+ "OpenOffice.org Infotip Handler" "" "Sun Microsystems, Inc." "c:\program files\openoffice.org 3\basis\program\shlxthdl\shlxthdl.dll"
+ "OpenOffice.org Property Sheet Handler" "" "Sun Microsystems, Inc." "c:\program files\openoffice.org 3\basis\program\shlxthdl\shlxthdl.dll"
+ "OpenOffice.org Thumbnail Viewer" "" "Sun Microsystems, Inc." "c:\program files\openoffice.org 3\basis\program\shlxthdl\shlxthdl.dll"
+ "PDF-XChange PDF Preview Provider" "PDF-XChange Shell Extention" "Tracker Software Products Ltd." "e:\pdf-exchange viewer\tracker software\shell extensions\xcshinfo.dll"
+ "PDF-XChange PDF Property Handler" "PDF-XChange Shell Extention" "Tracker Software Products Ltd." "e:\pdf-exchange viewer\tracker software\shell extensions\xcshinfo.dll"
+ "PDF-XChange PDF Thumbnail Provider" "PDF-XChange Shell Extention" "Tracker Software Products Ltd." "e:\pdf-exchange viewer\tracker software\shell extensions\xcshinfo.dll"
+ "Shell Extensions for RealOne Player" "RealPlayer Shell Extensions" "RealNetworks, Inc." "e:\real player\rpshell.dll"
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" "" "" ""
+ "FilterBHO Class" "WebToolBar component" "Kaspersky Lab" "c:\program files\kaspersky lab\kaspersky internet security 2010\klwtbbho.dll"
+ "Google Toolbar Notifier BHO" "GoogleToolbarNotifier" "Google Inc." "c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll"
+ "IEVkbdBHO Class" "IE Virtual Keyboard" "Kaspersky Lab" "c:\program files\kaspersky lab\kaspersky internet security 2010\ievkbd.dll"
+ "Java™ Plug-In 2 SSV Helper" "Java™ Platform SE binary" "Sun Microsystems, Inc." "c:\program files\java\jre6\bin\jp2ssv.dll"
+ "JQSIEStartDetectorImpl Class" "Java™ Quick Starter binary" "Sun Microsystems, Inc." "c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll"
+ "RealPlayer Download and Record Plugin for Internet Explorer" "RealPlayer Download and Record Plugin" "RealPlayer" "e:\real player\rpbrowserrecordplugin.dll"
+ "Spybot-S&D IE Protection" "SBSD IE Protection" "Safer Networking Limited" "e:\spybot-search & destroy\install\spybot - search & destroy\sdhelper.dll"
+ "SSVHelper Class" "Java™ Platform SE binary" "Sun Microsystems, Inc." "c:\program files\java\jre6\bin\ssv.dll"
"Task Scheduler" "" "" ""
+ "AppleSoftwareUpdate.job" "Apple Software Update" "Apple Inc." "c:\program files\apple software update\softwareupdate.exe"
+ "Google Software Updater.job" "gusvc" "Google" "c:\program files\google\common\google updater\googleupdaterservice.exe"
+ "GoogleUpdateTaskMachineCore.job" "Google Installer" "Google Inc." "c:\program files\google\update\googleupdate.exe"
+ "GoogleUpdateTaskMachineUA.job" "Google Installer" "Google Inc." "c:\program files\google\update\googleupdate.exe"
+ "XoftSpySE.job" "Xoftspy" "ParetoLogic" "e:\xoftspyse\xoftspy.exe"
"HKLM\System\CurrentControlSet\Services" "" "" ""
+ "AppMgmt" "Provides software installation services such as Assign, Publish, and Remove." "" "File not found: C:\WINDOWS\System32\appmgmts.dll"
+ "AVP" "Provides computer protection against viruses, dangerous software, network attacks, internet fraud and spam." "Kaspersky Lab" "c:\program files\kaspersky lab\kaspersky internet security 2010\avp.exe"
+ "Brother XP spl Service" "brsvc01a" "brother Industries Ltd" "c:\windows\system32\brsvc01a.exe"
+ "gupdate1c95bf6dea4b16c" "Keeps your Google software up to date. If this service is disabled or stopped, your Google software will not be kept up to date, meaning security vulnerabilities that may arise cannot be fixed and features may not work. This service uninstalls itself when there is no Google software using it." "Google Inc." "c:\program files\google\update\googleupdate.exe"
+ "gusvc" "Google Updater keeps your Google software up to date. If Google Updater Service is disabled or stopped, your Google software will not be kept up to date, meaning security vulnerabilities that may arise cannot be fixed and features may not work." "Google" "c:\program files\google\common\google updater\googleupdaterservice.exe"
+ "JavaQuickStarterService" "Prefetches JRE files for faster startup of Java applets and applications" "Sun Microsystems, Inc." "c:\program files\java\jre6\bin\jqs.exe"
+ "Pml Driver HPZ12" "PML Driver" "HP" "c:\windows\system32\hpzipm12.exe"
"HKLM\System\CurrentControlSet\Services" "" "" ""
+ "AFS2K" "Audio File System" "Oak Technology Inc." "c:\windows\system32\drivers\afs2k.sys"
+ "AgereSoftModem" "SoftModem Device Driver" "Agere Systems" "c:\windows\system32\drivers\agrsm.sys"
+ "ALCXWDM" "Realtek AC'97 Audio Driver (WDM)" "Realtek Semiconductor Corp." "c:\windows\system32\drivers\alcxwdm.sys"
+ "BrPar" "Brother Parallel class Driver version 1.01" "Brother Industries Ltd." "c:\windows\system32\drivers\brpar.sys"
+ "Changer" "" "" "File not found: C:\WINDOWS\System32\Drivers\Changer.sys"
+ "HPZid412" "IEEE-1284.4-1999 Driver (Windows 2000)" "HP" "c:\windows\system32\drivers\hpzid412.sys"
+ "HPZipr12" "IEEE-1284.4-1999 Print Class Driver" "HP" "c:\windows\system32\drivers\hpzipr12.sys"
+ "HPZius12" "1284.4<->Usb Datalink Driver (Windows 2000)" "HP" "c:\windows\system32\drivers\hpzius12.sys"
+ "i2omgmt" "" "" "File not found: C:\WINDOWS\System32\Drivers\i2omgmt.sys"
+ "kl1" "Kl1" "Kaspersky Lab" "c:\windows\system32\drivers\kl1.sys"
+ "klbg" "Kaspersky Lab Boot Guard" "Kaspersky Lab" "c:\windows\system32\drivers\klbg.sys"
+ "KLIF" "Kaspersky Lab Interceptor and Filter" "Kaspersky Lab" "c:\windows\system32\drivers\klif.sys"
+ "klim5" "Kaspersky Lab Intermediate Network Driver" "Kaspersky Lab" "c:\windows\system32\drivers\klim5.sys"
+ "klmouflt" "Kaspersky Lab Mouse Class Filter" "Kaspersky Lab" "c:\windows\system32\drivers\klmouflt.sys"
+ "lbrtfdc" "" "" "File not found: C:\WINDOWS\System32\Drivers\lbrtfdc.sys"
+ "nv" "NVIDIA Compatible Windows 2000 Miniport Driver, Version 56.73 " "NVIDIA Corporation" "c:\windows\system32\drivers\nv4_mini.sys"
+ "nv_agp" "NVIDIA nForce AGP Filter" "NVIDIA Corporation" "c:\windows\system32\drivers\nv_agp.sys"
+ "nvatabus" "NVIDIA® nForce™ IDE Performance Driver" "NVIDIA Corporation" "c:\windows\system32\drivers\nvatabus.sys"
+ "nvax" "NVIDIA® nForce™ MCP Audio Enumerator" "NVIDIA Corporation" "c:\windows\system32\drivers\nvax.sys"
+ "NVENET" "NVIDIA nForce MCP Networking Driver." "NVIDIA Corporation" "c:\windows\system32\drivers\nvenet.sys"
+ "nvnforce" "NVIDIA® nForce™ Audio Driver" "NVIDIA Corporation" "c:\windows\system32\drivers\nvapu.sys"
+ "pavboot" "Panda Boot Driver" "Panda Security, S.L." "c:\windows\system32\drivers\pavboot.sys"
+ "PCIDump" "" "" "File not found: C:\WINDOWS\System32\Drivers\PCIDump.sys"
+ "PDCOMP" "" "" "File not found: C:\WINDOWS\System32\Drivers\PDCOMP.sys"
+ "PDFRAME" "" "" "File not found: C:\WINDOWS\System32\Drivers\PDFRAME.sys"
+ "PDRELI" "" "" "File not found: C:\WINDOWS\System32\Drivers\PDRELI.sys"
+ "PDRFRAME" "" "" "File not found: C:\WINDOWS\System32\Drivers\PDRFRAME.sys"
+ "Ptilink" "Direct Parallel Link Driver" "Parallel Technologies, Inc." "c:\windows\system32\drivers\ptilink.sys"
+ "Secdrv" "SafeDisc driver" "" "c:\windows\system32\drivers\secdrv.sys"
+ "WDICA" "" "" "File not found: C:\WINDOWS\System32\Drivers\WDICA.sys"
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32" "" "" ""
+ "msacm.iac2" "Indeo® audio software" "Intel Corporation" "c:\windows\system32\iac25_32.ax"
+ "msacm.l3acm" "MPEG Layer-3 Audio Codec for MSACM" "Fraunhofer Institut Integrierte Schaltungen IIS" "c:\windows\system32\l3codeca.acm"
+ "msacm.sl_anet" "Audio codec for MS ACM" "Sipro Lab Telecom Inc." "c:\windows\system32\sl_anet.acm"
+ "msacm.trspch" "DSP Group TrueSpeech™ Audio Codec for MSACM V3.50" "DSP GROUP, INC." "c:\windows\system32\tssoft32.acm"
+ "vidc.cvid" "Cinepak® Codec" "Radius Inc." "c:\windows\system32\iccvid.dll"
+ "vidc.iv31" "" "" "c:\windows\system32\ir32_32.dll"
+ "vidc.iv32" "" "" "c:\windows\system32\ir32_32.dll"
+ "vidc.iv41" "Intel Indeo® Video 4.5" "Intel Corporation" "c:\windows\system32\ir41_32.ax"
+ "vidc.iv50" "Intel Indeo® video 5.10" "Intel Corporation" "c:\windows\system32\ir50_32.dll"
"HKLM\Software\Classes\Filter" "" "" ""
+ "Indeo® video 4.4 Compression Filter" "Intel Indeo® Video 4.5" "Intel Corporation" "c:\windows\system32\ir41_32.ax"
+ "Indeo® video 4.4 Decompression Filter" "Intel Indeo® Video 4.5" "Intel Corporation" "c:\windows\system32\ir41_32.ax"
"HKLM\Software\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance" "" "" ""
+ "ACELP.net Audio Decoder" "ACELP.net Audio Decoder" "Sipro Lab Telecom Inc." "c:\windows\system32\acelpdec.ax"
+ "CyberLink Video/SP Decoder (PDVD9)" "CyberLink Video/SP Filter" "CyberLink Corp." "e:\k-lite codec\k-lite codec pack\filters\clvsd.ax"
+ "DirectVobSub" "VobSub & TextSub filter for DirectShow/VirtualDub/Avisynth" "Gabest" "e:\k-lite codec\k-lite codec pack\filters\vsfilter.dll"
+ "DirectVobSub (auto-loading version)" "VobSub & TextSub filter for DirectShow/VirtualDub/Avisynth" "Gabest" "e:\k-lite codec\k-lite codec pack\filters\vsfilter.dll"
+ "ffdshow Audio Decoder" "DirectShow and VFW video and audio decoding/encoding/processing filter" "" "e:\k-lite codec\k-lite codec pack\ffdshow\ffdshow.ax"
+ "ffdshow Audio Processor" "DirectShow and VFW video and audio decoding/encoding/processing filter" "" "e:\k-lite codec\k-lite codec pack\ffdshow\ffdshow.ax"
+ "ffdshow raw video filter" "DirectShow and VFW video and audio decoding/encoding/processing filter" "" "e:\k-lite codec\k-lite codec pack\ffdshow\ffdshow.ax"
+ "ffdshow subtitles filter" "DirectShow and VFW video and audio decoding/encoding/processing filter" "" "e:\k-lite codec\k-lite codec pack\ffdshow\ffdshow.ax"
+ "ffdshow Video Decoder" "DirectShow and VFW video and audio decoding/encoding/processing filter" "" "e:\k-lite codec\k-lite codec pack\ffdshow\ffdshow.ax"
+ "Haali Matroska Muxer" "Haali Media Splitter" "" "e:\k-lite codec\k-lite codec pack\filters\haali\splitter.ax"
+ "Haali Media Splitter" "Haali Media Splitter" "" "e:\k-lite codec\k-lite codec pack\filters\haali\splitter.ax"
+ "Haali Media Splitter (AR)" "Haali Media Splitter" "" "e:\k-lite codec\k-lite codec pack\filters\haali\splitter.ax"
+ "Haali Simple Media Splitter" "Haali Media Splitter" "" "e:\k-lite codec\k-lite codec pack\filters\haali\splitter.ax"
+ "Haali Video Renderer" "" "" "e:\k-lite codec\k-lite codec pack\filters\haali\dxr.dll"
+ "Haali Video Sink" "Haali Media Splitter" "" "e:\k-lite codec\k-lite codec pack\filters\haali\splitter.ax"
+ "Indeo Video ® 5.1 Progressive Download Source" "Intel Indeo® video IVF Source Filter 5.10" "Intel Corporation" "c:\windows\system32\ivfsrc.ax"
+ "Indeo® audio software" "Indeo® audio software" "Intel Corporation" "c:\windows\system32\iac25_32.ax"
+ "Indeo® video 5.10 Compression Filter" "Intel Indeo® video 5.10" "Intel Corporation" "c:\windows\system32\ir50_32.dll"
+ "Indeo® video 5.10 Decompression Filter" "Intel Indeo® video 5.10" "Intel Corporation" "c:\windows\system32\ir50_32.dll"
+ "madFlac Decoder" "DirectShow FLAC Decoder" "www.madshi.net" "e:\k-lite codec\k-lite codec pack\filters\madflac.ax"
+ "madFlac Source" "DirectShow FLAC Decoder" "www.madshi.net" "e:\k-lite codec\k-lite codec pack\filters\madflac.ax"
+ "MPC - FLV Source (Gabest)" "FLV Splitter" "Gabest" "e:\k-lite codec\k-lite codec pack\filters\flvsplitter.ax"
+ "MPC - FLV Splitter (Gabest)" "FLV Splitter" "Gabest" "e:\k-lite codec\k-lite codec pack\filters\flvsplitter.ax"
+ "MPC - MP4 Source" "MP4 Splitter" "Gabest" "e:\k-lite codec\k-lite codec pack\filters\mp4splitter.ax"
+ "MPC - MP4 Splitter" "MP4 Splitter" "Gabest" "e:\k-lite codec\k-lite codec pack\filters\mp4splitter.ax"
+ "MPC - Mpeg Source (Gabest)" "Mpeg Splitter" "Gabest" "e:\k-lite codec\k-lite codec pack\filters\mpegsplitter.ax"
+ "MPC - Mpeg Splitter (Gabest)" "Mpeg Splitter" "Gabest" "e:\k-lite codec\k-lite codec pack\filters\mpegsplitter.ax"
+ "MPC - MPEG4 Video Source" "MP4 Splitter" "Gabest" "e:\k-lite codec\k-lite codec pack\filters\mp4splitter.ax"
+ "MPC - MPEG4 Video Splitter" "MP4 Splitter" "Gabest" "e:\k-lite codec\k-lite codec pack\filters\mp4splitter.ax"
+ "MPEG Layer-3 Decoder" "MPEG Layer-3 Audio Decoder" "Fraunhofer Institut Integrierte Schaltungen IIS" "c:\windows\system32\l3codecx.ax"
+ "RealPlayer Audio Filter" "Audio Filter Plugin" "RealNetworks, Inc." "e:\real player\rdsf3260.dll"
+ "RealPlayer Transcode Filter" "Audio Filter Plugin" "RealNetworks, Inc." "e:\real player\rdsf3260.dll"
+ "RealPlayer Video Filter" "Audio Filter Plugin" "RealNetworks, Inc." "e:\real player\rdsf3260.dll"
+ "WavPack Audio Decoder" "WavPack Audio DirectShow Decoder" "-" "e:\k-lite codec\k-lite codec pack\filters\wavpackdsdecoder.ax"
+ "WavPack Audio Splitter" "WavPack Audio DirectShow Splitter" "-" "e:\k-lite codec\k-lite codec pack\filters\wavpackdssplitter.ax"
+ "WIA Stream Snapshot Filter" "WIA Stream Snapshot Filter" "MyCompanyName" "c:\windows\system32\wiasf.ax"
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls" "" "" ""
+ "C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll" "Kaspersky OE plugin loader" "Kaspersky Lab" "c:\program files\kaspersky lab\kaspersky internet security 2010\kloehk.dll"
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify" "" "" ""
+ "klogon" "Logon Visualizer" "Kaspersky Lab" "c:\windows\system32\klogon.dll"
"HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors" "" "" ""
+ "Canon BJ Language Monitor MP490 series" "IJ Language Monitor" "CANON INC." "c:\windows\system32\cnmlm9y.dll"
+ "hpzsnt07" "" "HP" "c:\windows\system32\hpzsnt07.dll"

[othersteve]

Hey Jerry,

Please open Autoruns and uncheck the entries which correspond to the following (if they exist):

+ "Motive SmartBridge" "Motive SmartBridge" "Motive, Inc." "c:\program files\sbc self support tool\smartbridge\motivesb.exe"
+ "QuickTime Task" "QuickTime Task" "Apple Inc." "c:\program files\quicktime\qttask.exe"
+ "SunJavaUpdateSched" "Java™ Platform SE binary" "Sun Microsystems, Inc." "c:\program files\java\jre6\bin\jusched.exe"
+ "TkBellExe" "RealNetworks Scheduler" "RealNetworks, Inc." "c:\program files\common files\real\update_ob\realsched.exe"
+ "AT&T Self Support Tool.lnk" "Motive Chorus Command Line Interface" "Motive Communications, Inc." "c:\program files\sbc self support tool\bin\matcli.exe"
+ "Microsoft Office Fast Start.lnk" "" "" "h:\msoffice_w95\office\fastboot.exe"
+ "Uniblue RegistryBooster 2" "" "" "File not found: E:\REG BOOST\RegistryBooster 2\RegistryBooster.exe /S"
+ "RealPlayer Download and Record Plugin for Internet Explorer" "RealPlayer Download and Record Plugin" "RealPlayer" "e:\real player\rpbrowserrecordplugin.dll"
+ "lbrtfdc" "" "" "File not found: C:\WINDOWS\System32\Drivers\lbrtfdc.sys"

As for Spybot's TeaTimer...

It's really not the useful companion it used to be in the opinion of many experts (please see this thread for details). Personally, I would recommend considering disabling it, especially if we're going to consider updating to SP3 in the future. (To disable it, Run SpyBot->Tools->Resident->Uncheck TeaTimer.)

In fact, on that note, it might not be a bad idea, if you've had issues with the process in the past, to even consider removing your other security products before the SP3 update, and then reinstall following the update. It's a little bit of trouble (you'll have to note your license keys and all that stuff), but it's worth it to eliminate as many possible sources of problems as possible.

Finally, when all that's done, reboot your PC, and then let's finally attempt this permissions reset we had initially considered:

1. Download and install SubInACL from Microsoft. Install SubInACL in the default location.

2. Click Start > Run > type cmd and click OK

3. In the cmd prompt, type notepad reset.cmd and click yes to open Notepad.exe and create a new text file named reset.cmd

4. Copy and paste the following contents into reset.cmd:

cd /d "%programfiles%\Windows Resource Kits\Tools"

subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f
subinacl /subkeyreg HKEY_CURRENT_USER /grant=administrators=f
subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f
subinacl /subdirectories %SystemDrive% /grant=administrators=f

subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=system=f
subinacl /subkeyreg HKEY_CURRENT_USER /grant=system=f
subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=system=f
subinacl /subdirectories %SystemDrive% /grant=system=f

5. Save and close reset.cmd.

6. In the cmd prompt, type reset.cmd and press enter to run the SubInACL tool. This will take several minutes to complete.


After this, it might not be a bad idea to follow 123Runner's advice and try running the PC for a while. Let us know if you notice any issues with it in the meantime, and when you feel you're ready to attempt the round of updates, let us know!

(Meanwhile, if you have any questions about the current procedures, you can post them, of course.)

~os

[123Runner]

And do not use any of the cureall registry boosters. They do no good.

[Jerry23]

Hi OS,

How are you doing today? Thanks for all the direction given above. I hope you don't mind, but I decided to do it backwards - I used my computer for a while before I did what you outlined above & got back to you. That gave me an opportunity to catch up on some things I neglected very badly, while my computer was behaving poorly.

In general, I am quite pleased with the way my computer & IE8 have been performing. They have been quite stable, with 2 exceptions. You may remember this

>>>>>>>>
Well after a pretty successful day, it is ending on a sour note. I was in the process of shutting down for the day, when I got the Err Msg: IE has encountered a problem with an add-on & needs to close. File: Flash10c.exe, Adobe Flash Player. This seems to happen every 2-3 days. I had to do a hard turn-off after this. That does not happen very often.

This occurred in a pattern I mentioned before. It happened after a long day of heavy usage, followed by a period of sitting idle [~ 2 hrs], and after running a full scan. It has not been unusual for my computer to get unstable at the end of the day, following the pattern outlined above. This has been happening for many months now.

<<<<<

Well on 12/9/09 after the conditions described above, I had a similar problem. But this time, IE8 was not the problem. My Active Trader Pro [ATP] hung up. I was running Kapersky with ATP & 3 IE windows open with mutiple tabs on each. ATP is a memory hog - they recommend 1 gig memory min - which is what I have. Anyway, I was away from my computer. I decided to check on the status of the Kapers scan. My computer screen was in the rest mode. When I touched the mouse, the screen was 90% blank & stayed that way for 60-90 seconds before filling. Kap showed 70% complete & seemed to be stalled. I closed 1 IE window - it closed VERY slowly. I hit X to close ATP & got the"program not responding - End Now" window. I closed 2 other IE windows. Kap was now running smoothly. The next time I hit the mouse to check progress, the screen lit up & filled right away. It seems to me like I might have some problems associated with saturating my memory. What do you think?

The 2nd problem I had was on 12/11/09. I clicked on a link to a U C Berkely site [DOC]. It would not connect to the site & got hung up. ESC did not help. Ctrl Alt Del - End Task - Close tab - did not work. Ctrl Alt Del - End Task - Close tab - > Prog Not responding - End now - closed all tabs. Tried to open a Tab - hung up. Ctrl Alt Del - End task -the prog is not responding - end now - would not respond or close. After a few cycles of this it finally closed. Start-turn off computer-restart >> several screens came up closing various programs before it finally shut down. I got a window to install Adobe flash update - did it. After the reboot, it worked fine.

Since that last incident on 12/11, there have been no other problems with IE8. Now all the above happened before I did any of the things you outlined in your last post.

Today, 11/16, I did the things you requested.

I used autoruns to uncheck all the entries you listed except one. I left Real Player for IE checked. I like the window that comes up when I hover over a video. It makes it easy to DL if I want [this helps with an online class I am taking at U C Berkely].

I disabled TeaTimer. I wanted Spybot mostly for the Immunize function & to have another occassional check on malware detection.

I rebooted & then used SublnACL to reset the permissions as you requested. The results showed 1 item modified, 1 item failed, & 0 syntax errors. I saved the results if you would like to see them.

I ran sfc /scannow . No output.

I did the Autoruns uncheck & the TeaTimer disable earlier today. I have used the computer quite a bit since then with no problems. The computer appears to be running fine since resetting permissions. I do not notice any significant increase in performance/speed since doing the above.

Thanks again OS for all your help - it is much appreciated. Are we ready for the update to XP3 yet?

Regards,

Jerry

[othersteve]

Hey Jerry,

Apparently my subscription to this topic is no longer intact, as I missed your reply!

Anyhow, if you're still running smoothly, I'd say it's time to give SP3 a shot if you're comfortable with the idea. It is possible to uninstall it from the Recovery Console in case it fails or causes problems as long as you have the RC installed (and if you've ever run ComboFix in the past, you do). Alternatively, if you've got a copy of your original OS installation media, that'll work, too.

As for the problems you mentioned above, both could well have been related to the Adobe Flash Player, which your updating it may have already solved. If you want to try one other thing before your SP3 update, you might download and install the latest version of Sun Java as well, as I think ATP relies on it!

-Steve

Edited by othersteve, 31 December 2009 - 06:55 AM.

[123Runner]

I did not get an email either.

Do not update to SP 3 till the system is stable. There are to many reported issues that seem to be linked to a unstable system.
The same goes for a update from IE7 to IE 8.

Jerry23

Are you still having problems with the flash?
Go to tools...
Manage addons..
Disable flash temporarily and see if things are better.

You may have to uninstall it and then re-install it.

What Java version are you at?
Run JavaRa

* Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
* Accept any prompts.
* Open JavaRa.exe again and select Search For Updates.
* Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.

[othersteve]

123Runner,

The update to IE8 was performed successfully already almost a month ago. As for the other stability issues, none have been reported in the past three weeks at all. Those seem to be related to Flash and/or Java issues possibly as well.

I'm not certain, but as far as I can tell, this is as stable as things have been in a long time. Don't you think an update to SP3 might be the next step then?

~os

Edited by othersteve, 31 December 2009 - 07:50 AM.

[123Runner]

Thanks for the update.

I would attempt to fix flash and update java before going to SP 3.

I personnally have not gone to SP 3 on any of my computers. I have no issues.
In fact the company I work for has blocked the IE 8 and SP 3 update from installing.

Your choice on SP 3. It can always be un-installed.

What SP 3 fixes

[othersteve]

Cool, sounds like we're on the same page then.

Flash has been apparently fixed per the user's feedback and I recommended a Sun Java update above which should correct the issue. The removal of the old versions I understand is optional but helpful for security purposes. Still, I think it isn't necessarily required before attempting an SP3 update.

I think an attempt to update to SP3 would be reasonable at this point. If it fails, as you said, it is always uninstallable via the RC. I advised the user of this as well in my above post.

Thank you for your help.

~os

[happyrock]

Thanks for the update.


I personally have not gone to SP 3 on any of my computers. I have no issues.

What SP 3 fixes

DITTO...

[othersteve]

Hey, I'm all for holding off on SP3 also if the OP is okay with it. On one hand, it can't hurt to try (it does include some security enhancements after all and numerous fixes), but with some of the problems it can potentially cause I could understand that sentiment.