[rlmark]

Hi there guys! Thanks for taking the time to help me with my problems:

I'm running Windows XP SP3 on a Dell computer. I don't have any more details off the top of my head, but if you need more I can certainly find those for you.

Here's my problems:

1. Add/Remove Programs isn't showing the icons, a bunch of programs seemingly vanished (but the .exe's and shortcuts are still all present) and all of a sudden a bunch of weird programs showed up that I've never seen before and can't identify as being associated with something else. (e.g CP_AtenaShokunin1Config . what in the world?!)

2. System Restore has all the restore points, but upon try to restore to one, it is unable.

3. Every once in a while, i get a Windows- No Disk error. Every once in a while, it'll pop up, and even after clicking "continue", "try again", or "cancel", it'll pop up every 3 seconds until reboot. The specific error is "Exception Processing Message c0000013 Parameters 75b6bf7c 4 75b6bf7c 75b6bf7c". This also happens when I run certain programs like an old (2001) copy of Microsoft PictureIt! or Spybot Search and Destroy.

One interesting thing I notice about that error message is that when it pops up, i can move it to the bottom of the screen and continue activities that don't access the hard drive (i.e browsing the net), but in order for the computer to successfully open a program, or continue a virus scan/defrag, it'll have to be clicked on multiple times.

I had my computer thoroughly checked by the guys over at malwareremoval.com, and in fact, they're the ones that sent me here.

Thanks again for all your help!

[Advertisements]

you need to run sfc /scannow...
if you don't have a xp cd you will have to borrow one from a friend or coworker...
it has to be the same flavor of xp you have installed...IE: if you have xp pro...the one you borrow has to be xp pro

How to use Scannow sfc...

To do this click on start...run...then type in...sfc /scannow

This command will immediately initiate the Windows File Protection service to scan all protected files and verify their integrity, replacing any files with which it finds a problem.

for vista...
go to the run box and type in cmd
instead of hitting the Enter key press Ctrl+Shift + Enter You will be prompted with the obnoxious User Account Control dialog… but it will then open up a command prompt in Administrator mode...then type in sfc /scannow

NOTE THE SINGLE SPACE BEFORE THE /

[happyrock]

you need to run sfc /scannow...
if you don't have a xp cd you will have to borrow one from a friend or coworker...
it has to be the same flavor of xp you have installed...IE: if you have xp pro...the one you borrow has to be xp pro

How to use Scannow sfc...

To do this click on start...run...then type in...sfc /scannow

This command will immediately initiate the Windows File Protection service to scan all protected files and verify their integrity, replacing any files with which it finds a problem.

for vista...
go to the run box and type in cmd
instead of hitting the Enter key press Ctrl+Shift + Enter You will be prompted with the obnoxious User Account Control dialog… but it will then open up a command prompt in Administrator mode...then type in sfc /scannow

NOTE THE SINGLE SPACE BEFORE THE /

[rlmark]

OK, I did as you said, and the Windows File Protection window did open. I'm not sure if it actually did anything, but it finished. All the problems are still there. I rebooted just to make sure, and yup, they're still there.

Thanks, and waiting on further instructions...

[happyrock]

ok... this time click on start...run...then type in...chkdsk /r

if you get this message...
Chkdsk cannot run because the volume is in use by another process. Would you like to schedule this volume to be checked the next time the system restarts? type Y and reboot...
note the single space before the /

While chkdsk is running you will see a light blue window with a dark blue band at the top and bottom. or a black dos box depending on on which cd you use... Chkdsk will display the specific stage it is checking as well as the percentage of completion of the stage. You cannot do anything else on your computer while chkdsk is running. When chkdsk is finished, it will automatically reboot your computer.

NOTE this can take a long time to complete..it may even appear to hang or get stuck at a certain % for a couple of hours...then complete...it may even back up and go over the same area...this is normal...let it run...there are 5 stages
DO NOT TURN OFF YOUR COMPUTER WHILE RUNNING CHKDSK or you can have severe problems...


after this completes and you have rebooted then Go to Start...Run and type: eventvwr.msc press enter
When Event Viewer opens, click on Applications... then scroll down to Winlogon and double-click on it. This is the log created after running Checkdisk...copy and paste the log back here...

Edited by happyrock, 14 March 2010 - 06:34 AM.

[rlmark]

Here's the log. Just btw, in my first post i forgot to mention that in Add/Remove Programs there's no "remove" button for any of the programs, leading me to believe that there's something wrong with the registry entries for uninstall paths or something... The problems all still seem to be there.


Event Type: Information
Event Source: Winlogon
Event Category: None
Event ID: 1001
Date: 3/14/2010
Time: 10:18:02 AM
User: N/A
Computer: LIVINGROOM3
Description:
Checking file system on F:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.
Cleaning up minor inconsistencies on the drive.
Cleaning up 509 unused index entries from index $SII of file 0x9.
Cleaning up 509 unused index entries from index $SDH of file 0x9.
Cleaning up 509 unused security descriptors.
CHKDSK is verifying Usn Journal...
Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
Free space verification is complete.

156240125 KB total disk space.
107101600 KB in 148077 files.
57592 KB in 20058 indexes.
0 KB in bad sectors.
859957 KB in use by the system.
65536 KB occupied by the log file.
48220976 KB available on disk.

4096 bytes in each allocation unit.
39060031 total allocation units on disk.
12055244 allocation units available on disk.

Internal Info:
00 48 0b 00 d2 90 02 00 d1 d7 03 00 00 00 00 00 .H..............
6d 1e 00 00 06 00 00 00 ea 06 00 00 00 00 00 00 m...............
90 b6 e3 0c 00 00 00 00 c4 56 bf 9d 00 00 00 00 .........V......
7a a2 98 18 00 00 00 00 b2 2c 88 ea 08 00 00 00 z........,......
30 e9 05 e3 02 00 00 00 d6 61 e9 9a 0c 00 00 00 0........a......
40 3b 5e b2 00 00 00 00 b0 39 07 00 6d 42 02 00 @;^......9..mB..
00 00 00 00 00 80 f6 88 19 00 00 00 5a 4e 00 00 ............ZN..

Windows has finished checking your disk.
Please wait while your computer restarts.


For more information, see Help and Support Center at http://go.microsoft....link/events.asp.

[happyrock]

give me the link to your thread at Malwareremoval.com....
is your OS installed on the F drive
run chkdsk /r again until it does not find and fix any errors...then access the Winlogon file again and post the text again

Edited by happyrock, 14 March 2010 - 09:51 AM.

[rlmark]

OK, here's the MalwareRemoval thread: http://www.malwarere...o...=11&t=49620

Yes, my OS is installed on F: (that's my only harddrive, i'm not sure why it's F: and not C:)

I'll run chkdsk /r and post the log here when it's done.

[happyrock]

did you ever Download and run the Norton Removal Tool...from here...
I'm still reading the clean up at MalwareRemoval...it may take some time for me to complete I have my normal work to get done first...

[happyrock]

found this at your malware thread...there is only 2.83% Space Free on your F drive...if that's true that will be the cause of your problems...to verify what amount off free space you have...
click on my computer...right click on the F drive...properties...get a screenshot and post it for us...if you don't know how to post screenshot...go here...

[rlmark]

That was true at first but if you read further in the thread you'll see that I deleted plenty of stuff. There's now around 20% free. I can still post a screenshot if you wish once chkdsk finishes.

Yes, I did run the norton removal tool as well.

Edited by rlmark, 14 March 2010 - 10:19 AM.

[happyrock]

after further reading at the malware thread I see they addressed my concerns...
is this a home built system...
still I would like screenshots of both the F drive and the C drive properties...

[rlmark]

No, this is whatever we bought from Dell. It's an older computer, a Dimension 8300 Series perhaps?

Sure thing, when chkdsk is done i'll get that to you. I don't think the C: drive will have any properties because I think that it's the zip disk drive (which I don't use).

[rlmark]

Event Type: Information
Event Source: Winlogon
Event Category: None
Event ID: 1001
Date: 3/14/2010
Time: 1:13:13 PM
User: N/A
Computer: LIVINGROOM3
Description:
Checking file system on F:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.
Cleaning up minor inconsistencies on the drive.
Cleaning up 2 unused index entries from index $SII of file 0x9.
Cleaning up 2 unused index entries from index $SDH of file 0x9.
Cleaning up 2 unused security descriptors.
CHKDSK is verifying Usn Journal...
Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
Free space verification is complete.

156240125 KB total disk space.
107121032 KB in 148346 files.
57668 KB in 20079 indexes.
0 KB in bad sectors.
859957 KB in use by the system.
65536 KB occupied by the log file.
48201468 KB available on disk.

4096 bytes in each allocation unit.
39060031 total allocation units on disk.
12050367 allocation units available on disk.

Internal Info:
00 48 0b 00 f4 91 02 00 01 da 03 00 00 00 00 00 .H..............
6d 1e 00 00 06 00 00 00 ee 04 00 00 00 00 00 00 m...............
9c a6 92 0c 00 00 00 00 ce 69 78 9f 00 00 00 00 .........ix.....
60 04 4f 15 00 00 00 00 32 1d 83 ed 08 00 00 00 `.O.....2.......
48 42 d0 de 02 00 00 00 40 9b b7 97 0c 00 00 00 HB......@.......
60 89 5e b2 00 00 00 00 b0 39 07 00 7a 43 02 00 `.^......9..zC..
00 00 00 00 00 20 26 8a 19 00 00 00 6f 4e 00 00 ..... &.....oN..

Windows has finished checking your disk.
Please wait while your computer restarts.


For more information, see Help and Support Center at http://go.microsoft....link/events.asp.


----

Just FYI, as far as I can tell, all problems are still apparent.

Attached Thumbnails

• 
• 

[happyrock]

go to START..RUN...type in MSCONFIG...then click on OK or press ENTER..
click on START UP TAB...uncheck everything EXCEPT your AV and firewall...
unchecking them does not remove them ..they are still available to use...

the next thing we are going to do is turn off indexing ....its a resource hog and if you aren't searching for things on your computer 10 times a day it will only slow down your system....

click on start...my computer...right click on C: drive....properties...on the general tab..uncheck ...allow indexing on this drive....if you do not have the box on your system...

then START...RUN...type in SERVICES.MSC...then OK...scroll down until you find INDEXING SERVICE...click on it and in the general tab set it to DISABLED...then exit

To clean your temp folder, recycle bin, index.dat etc..please download this free tool...

CCleaner

Don't install any Toolbars, or other programs, should it ask you...Just
uncheck the option of installing the Yahoo toolbar....if you get
the slim version it does not have the toolbar
thats the one I recommend...
It will put a shortcut on your Desktop.

Click on CCleaner to start it....
Before first use...
Select Options then Advanced.
UNCHECK "Only delete files in Windows Temp folder older than 48 hours"
also UNCHECK Old Prefetch data..
The rest of the standard settings are fine...

Then click "Run Cleaner"

DO NOT USE ANY OF THE OTHER TOOLS...RUNNING THEM MAY CAUSE OTHER PROBLEMS

next get diskeeper lite here...

after installing it...click on the icon...close the "nag" screen...click on your F drive to select it ...then down towards the bottom ...click on defragment now...first time you use it it may take 30 minutes to a hour to complete...do it about every two weeks and it will complete in about 7 minutes...
reboot and tell me hows its running...

[rlmark]

The instructions went just fine until I hit the "Defragment Now" button in Diskeeper Lite. It gave me this error message: "MMC has detected an error in a snap-in. It is recommended that you shut down and restart MMC."

I chose the option that said "Report this error to Microsoft, and then shut down MMC." The same error came up next time, so I just said "Continue running and ignore errors with this snap-in for the rest of the session."

Just in case you want them, I attached the details from Diskeeper Lite.

I'm going to restart now and I'll post back with how things are running.

Attached Files

•  VolumeF.txt   18.15KB   138 downloads