[bike vault]

Hi,
In the last few days my PC has been showing this message shortly after booting up. Then a period of time later the entire PC freezes and is totally unresponsive. The off button is the only option - not good clearly.

The period of time to freeze varies considerably but if I use IE it is much shorter maybe a matter of ten minutes as oppose several hours if I remain out of IE.

I went back to a restore point to no avail.

I don't think this is malware as I am fairly savvy/wary IT wise.

My PC is intel quad core, vista sp2 32bit, I use Bit Defender Internet Security 2011.

I fear it maybe a hardware bad sector or bad memory issue.

Any assistance greatly appreciated!

Cheers,
Simon

Edited by bike vault, 23 November 2011 - 03:47 PM.

[Advertisements]

Hello bike vault and

Hit start button in lower left hand corner. Then in the run box type msconfig, then hit the services tab then hit put a check mark in hide microsoft services what is listed there,after hiding microsoft services?

Download CCLEANER the link below:

http://download.piri.../ccsetup312.exe


Just DONT us the registry cleaner function of CCleaner unless you know what you are deleting exactly!!

Then open ccleaner hit the tools button then startup second one down below uninstall then in the bottom right hand corner of ccleaner hit save to text file.Save it to your desktop and post the startup.txt here in your next reply.
Download autoruns http://download.sysi...es/Autoruns.zip unzipt it run it save to text file and post here in your next reply please.The default will be save as .arn file you will need to change that to save as .txt file.Also right click any startup entry that reads file not found and delete.


Listproccess
A very small program that simply lists the processes that Task Manager lists, including the full path name so you can see what program they are part of. You can easily copy and paste the list into a text file for before/after comparisons, or to email/forum when asking for computer help. You may be surprised at what is running on your computer! Some processes waste a lot of computer resources and make your computer sluggish.
Download ListProcesses for Windows HERE

http://www.softwares...stProcesses.exe Save the file to the desktop.

Once downloaded to the desktop
Double click the Listproccess Icon
Click run
When the window opens "select" GetList
Scroll to bottom of the window and click on Copy
Reply to this thread and paste the contents of the list so we can see it.


Please download MiniToolBox HERE http://download.blee...MiniToolBox.exe When the box opens click save file, save it to the desktop and run it.

Checkmark the following boxes:

Flush Dns
List Installed Programs
List Users, Partitions and Memory size
Click Go and post the result.

Edited by rockmilk, 23 November 2011 - 04:29 PM.

[rockmilk]

Hello bike vault and

Hit start button in lower left hand corner. Then in the run box type msconfig, then hit the services tab then hit put a check mark in hide microsoft services what is listed there,after hiding microsoft services?

Download CCLEANER the link below:

http://download.piri.../ccsetup312.exe


Just DONT us the registry cleaner function of CCleaner unless you know what you are deleting exactly!!

Then open ccleaner hit the tools button then startup second one down below uninstall then in the bottom right hand corner of ccleaner hit save to text file.Save it to your desktop and post the startup.txt here in your next reply.
Download autoruns http://download.sysi...es/Autoruns.zip unzipt it run it save to text file and post here in your next reply please.The default will be save as .arn file you will need to change that to save as .txt file.Also right click any startup entry that reads file not found and delete.


Listproccess
A very small program that simply lists the processes that Task Manager lists, including the full path name so you can see what program they are part of. You can easily copy and paste the list into a text file for before/after comparisons, or to email/forum when asking for computer help. You may be surprised at what is running on your computer! Some processes waste a lot of computer resources and make your computer sluggish.
Download ListProcesses for Windows HERE

http://www.softwares...stProcesses.exe Save the file to the desktop.

Once downloaded to the desktop
Double click the Listproccess Icon
Click run
When the window opens "select" GetList
Scroll to bottom of the window and click on Copy
Reply to this thread and paste the contents of the list so we can see it.


Please download MiniToolBox HERE http://download.blee...MiniToolBox.exe When the box opens click save file, save it to the desktop and run it.

Checkmark the following boxes:

Flush Dns
List Installed Programs
List Users, Partitions and Memory size
Click Go and post the result.

Edited by rockmilk, 23 November 2011 - 04:29 PM.

[bike vault]

Hi Rockmilk,

I've attached everything I think you require.

Hope you can make some sense of it!

Cheers,
Simon  AutoRuns.txt   59.92KB   186 downloads  minitoolboxResult.txt   6.3KB   235 downloads  processes.txt   1.1KB   236 downloads  startup.txt   4.51KB   264 downloads

[rockmilk]

Open ccleaner and disable the entries below.


Yes HKCU:Run WindowsWelcomeCenter rundll32.exe oobefldr.dll,ShowWelcomeCenter
Yes HKCU:Run ehTray.exe C:\Windows\ehome\ehTray.exe

Yes HKLM:Run LogMeIn GUI "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe" (optional)
Yes HKLM:Run AppleSyncNotifier C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe

Yes HKLM:Run Reader Library Launcher C:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe
Yes HKLM:Run RtHDVCpl C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

Yes HKLM:Run QuickTime Task "C:\Program Files\QuickTime\QTTask.exe" -atboottime
Yes HKLM:Run APSDaemon "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
Yes HKLM:Run iTunesHelper "C:\Program Files\iTunes\iTunesHelper.exe"
Yes HKLM:Run Adobe Reader Speed Launcher "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
Yes HKLM:Run Adobe ARM "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"


Yes Startup User Dropbox.lnk C:\Users\harrisons-PC-new\AppData\Roaming\Dropbox\bin\Dropbox.exe
Yes Startup User WePrint Server.lnk C:\Program Files\WePrint\WePrint Server.exe

Next: uninstall these programs.
Google Update Helper (Version: 1.3.21.79)
Norton Internet Security (Version: 16.0.0.125) Then run the norton removal tool found here.
http://majorgeeks.co...131482b8e4a8e42
Rapport (Version: 3.5.1108.55) (unless you need this program it can cause issues)


After completing the above task then Please download TFC by Old Timer and save it to your desktop.
http://oldtimer.geekstogo.com/TFC.exe
Save any unsaved work. TFC will close ALL open programs including your browser!
Double-click on TFC.exe to run it.If TFC doesnt prompt a reboot then please do so manually

Working on the services will get back to you asap

Edited by rockmilk, 23 November 2011 - 05:15 PM.

[rockmilk]

Hit start button at lower left hand corner of the screen.Then in the run box type services.msc. Find the service listed below,one at a time. left click it once you should have the option to either stop the service or restart it , stop the service then right click selected service select properties then change the startup type to manual then left click apply and move on to the next service.If the service is stopped and the startup type is manual then do nothing.




Apple Mobile Device
Bonjour Service
Google Desktop Manager 5.9.10...
Google Update Service (gupdate)
Google Update Service (gupdatem)
Google Software Updater
iPod Service
LogMeIn All entries to do with log mein (optional)
Nas Pm Service
Nero BackItUp Scheduler 3
NMIndexingService
SolidWorks Licensing Service
Sony SCSI Helper Service
Rapport Management Service
PLFlas DeviceIoControl Service

After completion of the above task reboot your pc and tell me how it is running.

[bike vault]

Hi rock milk.
Had to leave it last night - sleep called.
Okay I've done all of this..

I couldn't see how to uninstall google update helper.
Rapport service stopped but couldn't make manual - access denied.

Post old timer but per services.msc I still had the same messages and IE crashed. Screen grab attached..

Well it will be, I'm typing this on my iPad and pc is rebooting so will attach shortly.

Thank you for your help to date.
Cheers Simon

Additional. Reboot complete tasktrayapplication dialogue has just appeared.
IE working currently

[bike vault]

screen grab..

[bike vault]

Hi Rockmilk,

Well the tasktray error message is still comimg up, but not freezes today.

I wonder whether the error above is one problem and perhaps something else then tripped it over to a freeze..

Out of the woods yet? Don't know.

Cheers,

Simon

[rockmilk]

You will need to boot into safemode to remove rapport but that is up to you. http://www.trusteer....rusteer-rapport
The next thing I want you to do is run sfc /scannow. Here is a link explaining.
http://www.howtogeek...a-system-files/

Can I see an updated startup list from ccleaner please.

Also try and reset your ie http://support.microsoft.com/kb/923737 if you are still receiving ie error.

Edited by rockmilk, 24 November 2011 - 05:01 PM.

[bike vault]

Hi Rockmilk,

Okay, I've left Rapport on the system but it isn't running any more..

scannow failed at 41% - see attached snip.

ccleaner startup file attached.

everything is more stable so even though the tasktray error comes up after every boot it doesn't seem to cause a freeze currently.

I've left the IE fix for now as it seems it will revert to a virgin version with no settings in at all - might be good for IE but I'm not sure that sounds good for me! :-)

Cheers,
Simon
 startup new.txt   4.45KB   223 downloads

[Macboatmaster]

1. Please check in Device Manager for any warning on drivers. On the view tab, click Show Hidden Devices and check those as well please.
If that does show errors, either post for advice please or take the appropriate action.

2. If the above check is negative OR after correcting errors, proceed to a chkdsk /r command pls.
Please post the results of that check using event viewer. It is in Windows logs, application, wininit.
If you wish on application click Find in the right hand pane - type chkdsk and then click copy in the right hand pane.
Then paste to reply please.

3. If chkdsk does not reveal file errors, other than the normal clean up of security descriptions etc proceed to 4 please. Please ensure you check if bad sectors are found.

4. Windows Memory diagnostics - check your ram please.
At the black screen after the post screen press spacebar - you must do this on that black scren so you only have a split second

Tab to the WMD and then when that is highlighted key Enter
Go from there please and report that result please if other then NO errors.

[bike vault]

Evening Macboatmaster,

Devices are showing errors as attached. Before the above procedures there were no errors so I guess these have been flushed out as part of the corrective work.

All errors had the same dialogue description (attached).

I haven't proceeded beyond thus point..I clicked check for solutions but nothing came back.

[Macboatmaster]

They are of no great importance at this time.

Proceed pls with chkdsk and memory check.


On his post 4, my colleague rockmilk mentioned, entirely correctly - the Norton installation on your computer.
Please would you confirm that you have UNINSTALLED running the Norton removal tool.
However I would like you to go here

https://www-secure.s...n=1&pvid=f-home

and run the Norton Removal Tool after selecting, the appropriate entry, the Tool download page will appear.
Please do not use ANY offered Norton utilities on that page OTHER than the Removal tool

With Norton installed EVEN if it was not running and BitDefender running -you may well encounter all manner of errors

[bike vault]

Morning Macboatmaster,

I can confirm that the Norton uninstall from Rockmilk was run and also that it took a long time to do so.

The below is the chkdsk result - had to go to bed when that was running.

Do you still want me to run your Norton utility?

Doing the memory check now..

Thanks for your help.

Cheers,

Simon


Log Name: Application
Source: Microsoft-Windows-Wininit
Date: 26/11/2011 00:29:08
Event ID: 1001
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: harrisons-new
Description:


Checking file system on C:
The type of the file system is NTFS.
Volume label is SYSTEM.

A disk check has been scheduled.
Windows will now check the disk.
297920 file records processed.

529 large file records processed.

0 bad file records processed.

0 EA records processed.

76 reparse records processed.

370264 index entries processed.

0 unindexed files processed.

297920 security descriptors processed.

Cleaning up 156 unused index entries from index $SII of file 0x9.
Cleaning up 156 unused index entries from index $SDH of file 0x9.
Cleaning up 156 unused security descriptors.
36173 data files processed.

CHKDSK is verifying Usn Journal...
35393792 USN bytes processed.

Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
297904 files processed.

File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
13938847 free clusters processed.

Free space verification is complete.
Windows has checked the file system and found no problems.

206670847 KB total disk space.
150369924 KB in 230415 files.
131268 KB in 36174 indexes.
0 KB in bad sectors.
414267 KB in use by the system.
65536 KB occupied by the log file.
55755388 KB available on disk.

4096 bytes in each allocation unit.
51667711 total allocation units on disk.
13938847 allocation units available on disk.

Internal Info:
c0 8b 04 00 69 11 04 00 65 a2 06 00 00 00 00 00 ....i...e.......
d9 16 00 00 4c 00 00 00 00 00 00 00 00 00 00 00 ....L...........
42 00 00 00 52 73 b0 77 a8 56 32 00 a8 4e 32 00 B...Rs.w.V2..N2.

Windows has finished checking your disk.
Please wait while your computer restarts.

Event Xml:
<Event xmlns="http://schemas.micro.../events/event">
<System>
<Provider Name="Microsoft-Windows-Wininit" Guid="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" EventSourceName="Wininit" />
<EventID Qualifiers="16384">1001</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2011-11-26T00:29:08.000Z" />
<EventRecordID>77324</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>harrisons-new</Computer>
<Security />
</System>
<EventData>
<Data>

Checking file system on C:
The type of the file system is NTFS.
Volume label is SYSTEM.

A disk check has been scheduled.
Windows will now check the disk.
297920 file records processed.

529 large file records processed.

0 bad file records processed.

0 EA records processed.

76 reparse records processed.

370264 index entries processed.

0 unindexed files processed.

297920 security descriptors processed.

Cleaning up 156 unused index entries from index $SII of file 0x9.
Cleaning up 156 unused index entries from index $SDH of file 0x9.
Cleaning up 156 unused security descriptors.
36173 data files processed.

CHKDSK is verifying Usn Journal...
35393792 USN bytes processed.

Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
297904 files processed.

File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
13938847 free clusters processed.

Free space verification is complete.
Windows has checked the file system and found no problems.

206670847 KB total disk space.
150369924 KB in 230415 files.
131268 KB in 36174 indexes.
0 KB in bad sectors.
414267 KB in use by the system.
65536 KB occupied by the log file.
55755388 KB available on disk.

4096 bytes in each allocation unit.
51667711 total allocation units on disk.
13938847 allocation units available on disk.

Internal Info:
c0 8b 04 00 69 11 04 00 65 a2 06 00 00 00 00 00 ....i...e.......
d9 16 00 00 4c 00 00 00 00 00 00 00 00 00 00 00 ....L...........
42 00 00 00 52 73 b0 77 a8 56 32 00 a8 4e 32 00 B...Rs.w.V2..N2.

Windows has finished checking your disk.
Please wait while your computer restarts.
</Data>
</EventData>
</Event>

[bike vault]

Hi Macboatmaster,

Run the memory check but I don't know where the log is?

This error was in event manager as it shuts down - don't know if it's relevant?
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

DETAIL -
1 user registry handles leaked from \Registry\User\S-1-5-21-1413803913-1652693615-406530422-1000_Classes:
Process 336 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-1413803913-1652693615-406530422-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

Should I uninstall the protable device errors in Device Manager?

I assume they'll refind and reinstall if they're required again at some point?

Cheers,

Simon