[b. cripps]

Thanx for this great service. Please excuse brisk description of problem... must complete before Freeze-Up!!!

Cursor and functions freeze up after 5 mins. of use. Ran Clean-Up, Ad-aware, CWShredder, Spybot with no success. The computer freezes up during the running of Ewido, Trend and AVG... all at the same file C:\WINNT\System 32\wberm\Logs\wbemcore.log

Ran scans in Safe Mode.

And I have updated my Windows Service Packs.

When computer freezes, I have to toggle the power switch to reboot.

Hijack Log:

Logfile of HijackThis v1.99.1
Scan saved at 1:35:03 PM, on 5/16/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\SYSTEM32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\LEXPPS.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Documents and Settings\Administrator\Desktop\HijackThis.exe

O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\system32\msjava.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe

Appreciate your help...
B. Cripps

[Advertisements]

Can you check your message for a typo?
I think that should read: C:\WINNT\System32\wbem\Logs\wbemcore.log

Turn of the resident protection of your AV and find that file.
Rightclick it and open it in notepad.

Post the content please.
If you can't or if it's too big, rename it to wbemcore.txt and attach it to your next post.

Regards,

[Metallica]

Can you check your message for a typo?
I think that should read: C:\WINNT\System32\wbem\Logs\wbemcore.log

Turn of the resident protection of your AV and find that file.
Rightclick it and open it in notepad.

Post the content please.
If you can't or if it's too big, rename it to wbemcore.txt and attach it to your next post.

Regards,

[b. cripps]

Hi Metallica and thank you for responding to my little problem.

Your instructions are a little beyond me, but I would like to learn if you can walk me through the procedure.

I hit the Start button and then did a search for C:\WINNT\System32\wbem\Logs\wbemcore.log (you are right about the typo!), and tried to open it with Note Pad but no success. The system freezes intermittently and finally times out.

I noticed the file is 38 KB. Is that a large file? What would happen if I deleted the file?

Anyway, I defer to your expertise. How would you like me to proceed?

With thanks...
Bryan Cripps

[Metallica]

Hi Bryan,

I have looked for an indication of what would happen if you deleted that file. I couldn't find it.
Usually that is a good sign. If it were a vital file I could normally dig up some posts that read "I deleted the wrong file and my computer went up in smokes"

All mine says is:
(Sun Feb 01 08:51:23 2004.164703) : Failed to pre-process an instance using a property provider. Error code: 8004100A

My plan was to empty yours, because I suspect there is something in it that shouldn't be there.

My plan now is this:

*Click Here to download Killbox by Option^Explicit.
*Extract the program to your desktop and double-click on its folder, then double-click on Killbox.exe to start the program.
*In the killbox program, select the "Standard File Kill"option and put a checkmark in the "End Explorer Shell While killing File" box
*Then (and that is important in this case) copy & paste
C:\WINNT\System32\wbem\Logs\wbemcore.log
into the "Full Path of File to Delete" window.
*Click the red-and-white "Delete File" button.

Your taskbar and desktop will disappear for a very short time because Explorer is stopped while the file gets deleted.

Then go to the folder C:\WINNT\System32\wbem\Logs rightclick at an empty space in it and choose New File > Text document
Name it wbemcore.log and leave it empty.

Let me know if that helps.

Regards,

[b. cripps]

Greetings from sunny Florida, Metalica!

Thanks again for your help.

I performed the first step using Killbox. I got a window when I hit the red-and-white button asking if I wanted to “Backup & Delete” and I selected yes. The file was then deleted.

I then went to the “Start” button and clicked on Search for files & folders and entered C:\WINNT\System 32\wbem\Logs to attempt to rename it wbemcore.log as you requested but got a window saying “C:WINNT is not accessible. This folder was moved or removed.” ???

Now the good news… I did a complete virus scan (the first time in a long time that I’ve been able to do this without the computer freezing up!!!), and nothing was found. It would appear that whatever was causing the problem was contained within that file and, thanks to you, is now gone.

Any further words of wisdom?

Personal regards,
Bryan Cripps

[Metallica]

I think you misunderstood how to create the file, but from your story it appears Windows doesn't need it or will create it when it does.

So, all's well if you're happy.

Regards,

[b. cripps]

Thanks so much!
Bry

[Metallica]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.