[RKinner]

Try to synch the clock to one of the .gov sources. They seem to work more reliably than microsoft.com

Right click on Start and select Explore. Find the U:\ drive and right click on it. Is there an option to disconnect the network drive? Or something like that? If so tell it to disconnect.

Ron

[Advertisements]

I was successful in syncing the clock to a gov. site.

I followed your suggestion on the U drive. When I clicked "disconnect" I received the following message:

"There are currently files open on U: (connected to \\kfff2k3\user\crohloff). If you do not close the files before disconnecting from the network device, data may be lost. Do you want to disconnect anyway?"

I chose to disconnect.

After disconnecting the U drive no longer appears when I right click start and choose explore.

[THX1136]

I was successful in syncing the clock to a gov. site.

I followed your suggestion on the U drive. When I clicked "disconnect" I received the following message:

"There are currently files open on U: (connected to \\kfff2k3\user\crohloff). If you do not close the files before disconnecting from the network device, data may be lost. Do you want to disconnect anyway?"

I chose to disconnect.

After disconnecting the U drive no longer appears when I right click start and choose explore.

[RKinner]

Great. Someone had just mapped a network drive back to itself.
Getting it off the domain is hard without the domain administrator password. There is a way but it's sort of risky: See the last post on

http://www.velocityr...domain-how.html

More on Sysprep here:
http://support.microsoft.com/kb/302577

[THX1136]

I'm still waiting to talk to my manager about the password. I also have a query in with our engineer - currently on vacation - about the password as he was here when the whole thing was originally set up. I will review the links you shared.

I will post when I have made further progress. Thanks again for your time on this.

[THX1136]

I talked with my manager and the engineer - neither one knew the password. I also reviewed the information on getting the PC off of the domain. I am somewhat reluctant to continue on that tack due to implied danger of doing so. I would rather not have to seemingly "start over" should something go awry.

Right now the PC is working well for my manager. He is able to do all that he needs to do with it. The performance is acceptable. I believe what you have taken me through has gotten rid of any malware concerns - and Ztruker's help took care of the other issues the PC was having. The only lingering question for me personally is the large amount of fragmentation on the C drive. I would guess it to be at 75%+ now. Prehaps this is not a concern as my manager is using the other drive to save documents and other files to.

In light of all that what would be your advice as far as proceeding? Thank you for all your time and help on this. I do sincerely appreciate it.

[RKinner]

I don't see an anti-virus on this PC. I think you can install MSSE for free: http://windows.micro...rity-essentials

It won't load the PC down as much as Norton and is a lot better than McAfee.

As far as the defrag goes. After you run the XP defrag or just let it Analyze, there is an option to View Report. If you View Report then click on Save As then OK you get a text file called VolumeC.txt (usually it saves it to My Documents but watch to make sure you know where it is going). Can you copy and paste or Attach the file?

Ron

[THX1136]

Here's is the report.


Volume (C:)
Volume size = 74.49 GB
Cluster size = 4 KB
Used space = 61.73 GB
Free space = 12.76 GB
Percent free space = 17 %

Volume fragmentation
Total fragmentation = 42 %
File fragmentation = 83 %
Free space fragmentation = 1 %

File fragmentation
Total files = 55,669
Average file size = 2 MB
Total fragmented files = 663
Total excess fragments = 76,850
Average fragments per file = 2.38

Pagefile fragmentation
Pagefile size = 1.50 GB
Total fragments = 942

Folder fragmentation
Total folders = 5,103
Fragmented folders = 6
Excess folder fragments = 6

Master File Table (MFT) fragmentation
Total MFT size = 160 MB
MFT record count = 64,843
Percent MFT in use = 39 %
Total MFT fragments = 6

--------------------------------------------------------------------------------
Fragments File Size Most fragmented files
1,857 142 MB \Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\vd36a802.vdb
1,855 120 MB \Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\vd35a409.vdb
1,815 139 MB \Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\vd367205.vdb
1,800 112 MB \Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\vd34c202.vdb
1,769 135 MB \Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\vd364202.vdb
1,731 108 MB \Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\vd348603.vdb
1,698 108 MB \Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\vd348802.vdb
1,646 120 MB \Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\vd35a602.vdb
1,576 121 MB \Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\vd35b002.vdb
1,375 114 MB \Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\vd353a02.vdb
1,326 135 MB \Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\vd364402.vdb
1,287 121 MB \Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\vd35a804.vdb
1,257 139 MB \Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\vd367007.vdb
1,203 112 MB \Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\vd34c402.vdb
1,180 115 MB \Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\vd356002.vdb
1,144 73 MB \WINDOWS\Driver Cache\i386\driver.cab
979 121 MB \Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\vd35b202.vdb
956 138 MB \Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\vd366802.vdb
955 121 MB \Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\vd35ac01.vdb
919 139 MB \Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\vd367801.vdb
909 121 MB \Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\vd35aa02.vdb
844 139 MB \Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\vd367403.vdb
786 135 MB \Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\vd364602.vdb
762 121 MB \Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\vd35ae02.vdb
758 114 MB \Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\vd353c02.vdb
728 132 MB \Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\vd362607.vdb
704 115 MB \Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\vd356203.vdb
672 122 MB \Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\vd35ba02.vdb
665 121 MB \Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\vd35b604.vdb
654 106 MB \Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\vd346218.vdb


Is the Malware program not anti-virus then? I removed Symantec in the thread that Ztruker helped me on - if I'm remembering correctly. I could not remove it using the Norton tool. I had to do it through "Add/Remove" in Control Panels. Seems like it did not remove by looking at this report.

Edited by THX1136, 02 February 2012 - 04:36 PM.

[RKinner]

Pretty big files whatever they are and not something we need. I would right click on the Recycle Bin and select Properties and click on Don't move files to the recycle bin... OK

Then use Explorer or My Computer to navigate to:

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\ and then delete each file in the folder. Then delete the folder.

Then see if you can run defrag.

[THX1136]

Thanks Ron. I'll try this tomorrow if I get the chance. Either way I'll post the outcome after I try your suggestion.

[THX1136]

I could not find the exact string in Documents and Settings. The "All Users" folder only contained Desktop, Favorites, Shared Documents and Start Menu. I did look in each of those even though they were outside the string and did not find Application Data.

There was an Application Data folder in C\Qoobox\Quarantine\C\Documents\Temp. It was empty. I did a search for Symantec. I deleted the folders I found for that since it is supposed to be uninstalled.

Any thoughts on my next steps?

[RKinner]

Can you see System Hidden files and folders?

Close all programs so that you are at your desktop.
Double-click on the My Computer icon.
Select the Tools menu and click Folder Options.
After the new window appears select the View tab.
Put a checkmark in the checkbox labeled Display the contents of system folders.
Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
Remove the checkmark from the checkbox labeled Hide file extensions for known file types.
Remove the checkmark from the checkbox labeled Hide protected operating system files.
Press the Apply button and then the OK button and exit My Computer.
Now your computer is configured to show all hidden files.

[THX1136]

I was not able to do it exactly according to directions - there was no My Computer icon on the DT. I went to "folder options" and clicked show hidden files. I deleted all the Symantec stuff and voila 83% of the C drive had free space. I am currently defragging now. I did think of hidden files just before I looked at your reply. Should have thought of that.

I'm about at the end of my day here. I will let you know if anything comes up that doesn't look right. As of right now things look good.

Thanks again for your help. I do appreciate it.

[THX1136]

It appears that things are still not completely right. Here's what I am seeing now.

When I change something - like my manager's screensaver selction - Windows Installer starts up. When I've tried to open IE - Windows Installer starts up. It seems to be random and related only to Windows items.

Another thing: When I came into work today the PC had crashed. There was an Open Office document open and I think that was the culprit (it's happened to me in the past any way). The PC was at the login screen. I logged in and things looked normal in startup. When the desktop came up the background was not what my manager had selected. Also the recovery screen for the Open Office document opened. I recovered the document. I then tried to reset the display background. I could not re-select his selection in the Displays control panel. On further investigation I discovered that the step taken to deal with the U drive most likely altered this. The "My Pictures" and the like were in the string kfff2k3\crohloff\xxxxx which disappeared along with the U drive when I disconnected.

I removed most of the items that were downloaded during the process of checking for malware you lead me through yesterday also. I can't think of anything else that was done right now. My manager was not in yesterday so no one other than myself has done anything with the PC other than the defrag I performed on Friday 2/3 - and the steps I took on the Thurs. the 2nd.

How would you advise I proceed from here? The thought I had was undoing the U drive disconnection. Would this be "safe" since the Syamantec files have been deleted? Look forward to your input. Thanks for your help.

[RKinner]

Don't see a point in redoing the U drive. It was a mistake in the first place for it to be there.

Let's see if it left us an error:

1. Please download the Event Viewer Tool by Vino Rosso
http://images.malwar...om/vino/VEW.exe
and save it to your Desktop:
2. Double-click VEW.exe
3. Under 'Select log to query', select:

* System
4. Under 'Select type to list', select:
* Error
* Warning


Then use the 'Number of events' as follows:


1. Click the radio button for 'Number of events'
Type 20 in the 1 to 20 box
Then click the Run button.
Notepad will open with the output log.


Please post the Output log in your next reply then repeat but select Application.

Ron

[THX1136]

One thing I forgot to mention I was not able to install MSSE as you had suggested. I was given a dialog that said it was unable to find the volume kfff\crohloff. I am thinking that disappeared when I did the U drive disconnect. I chose "current user (KFFF\crohloff)" when asked which user account I want to run it under.

Here are the results of the two runs with VEW:


Vino's Event Viewer v01c run on Windows XP in English
Report run at 08/02/2012 7:44:21 AM

Note: All dates below are in the format dd/mm/yyyy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 08/02/2012 4:26:01 AM
Type: error Category: 0
Event: 5719 Source: NETLOGON
No Domain Controller is available for domain KFFF due to the following: There are currently no logon servers available to service the logon request. . Make sure that the computer is connected to the network and try again. If the problem persists, please contact your domain administrator.

Log: 'System' Date/Time: 08/02/2012 12:26:01 AM
Type: error Category: 0
Event: 5719 Source: NETLOGON
No Domain Controller is available for domain KFFF due to the following: There are currently no logon servers available to service the logon request. . Make sure that the computer is connected to the network and try again. If the problem persists, please contact your domain administrator.

Log: 'System' Date/Time: 07/02/2012 8:26:00 PM
Type: error Category: 0
Event: 5719 Source: NETLOGON
No Domain Controller is available for domain KFFF due to the following: There are currently no logon servers available to service the logon request. . Make sure that the computer is connected to the network and try again. If the problem persists, please contact your domain administrator.

Log: 'System' Date/Time: 07/02/2012 4:26:00 PM
Type: error Category: 0
Event: 5719 Source: NETLOGON
No Domain Controller is available for domain KFFF due to the following: There are currently no logon servers available to service the logon request. . Make sure that the computer is connected to the network and try again. If the problem persists, please contact your domain administrator.

Log: 'System' Date/Time: 07/02/2012 12:26:00 PM
Type: error Category: 0
Event: 5719 Source: NETLOGON
No Domain Controller is available for domain KFFF due to the following: There are currently no logon servers available to service the logon request. . Make sure that the computer is connected to the network and try again. If the problem persists, please contact your domain administrator.

Log: 'System' Date/Time: 07/02/2012 8:23:29 AM
Type: error Category: 0
Event: 7000 Source: Service Control Manager
The LogMeIn Kernel Information Provider service failed to start due to the following error: The system cannot find the path specified.

Log: 'System' Date/Time: 07/02/2012 8:23:29 AM
Type: error Category: 0
Event: 14325 Source: WMPNetworkSvc
Service 'WMPNetworkSvc' did not start correctly because QueryService encountered error '0x80004002'. In Windows Media Player, turn off media sharing, and then turn it back on.

Log: 'System' Date/Time: 07/02/2012 8:23:22 AM
Type: error Category: 0
Event: 5719 Source: NETLOGON
No Domain Controller is available for domain KFFF due to the following: There are currently no logon servers available to service the logon request. . Make sure that the computer is connected to the network and try again. If the problem persists, please contact your domain administrator.

Log: 'System' Date/Time: 07/02/2012 7:17:02 AM
Type: error Category: 0
Event: 5719 Source: NETLOGON
No Domain Controller is available for domain KFFF due to the following: There are currently no logon servers available to service the logon request. . Make sure that the computer is connected to the network and try again. If the problem persists, please contact your domain administrator.

Log: 'System' Date/Time: 07/02/2012 3:15:56 AM
Type: error Category: 0
Event: 7000 Source: Service Control Manager
The LogMeIn Kernel Information Provider service failed to start due to the following error: The system cannot find the path specified.

Log: 'System' Date/Time: 07/02/2012 3:15:56 AM
Type: error Category: 0
Event: 14325 Source: WMPNetworkSvc
Service 'WMPNetworkSvc' did not start correctly because QueryService encountered error '0x80004002'. In Windows Media Player, turn off media sharing, and then turn it back on.

Log: 'System' Date/Time: 07/02/2012 3:15:48 AM
Type: error Category: 0
Event: 5719 Source: NETLOGON
No Domain Controller is available for domain KFFF due to the following: There are currently no logon servers available to service the logon request. . Make sure that the computer is connected to the network and try again. If the problem persists, please contact your domain administrator.

Log: 'System' Date/Time: 07/02/2012 12:10:12 AM
Type: error Category: 0
Event: 5719 Source: NETLOGON
No Domain Controller is available for domain KFFF due to the following: There are currently no logon servers available to service the logon request. . Make sure that the computer is connected to the network and try again. If the problem persists, please contact your domain administrator.

Log: 'System' Date/Time: 06/02/2012 8:07:02 PM
Type: error Category: 0
Event: 5719 Source: NETLOGON
No Domain Controller is available for domain KFFF due to the following: There are currently no logon servers available to service the logon request. . Make sure that the computer is connected to the network and try again. If the problem persists, please contact your domain administrator.

Log: 'System' Date/Time: 06/02/2012 4:02:02 PM
Type: error Category: 0
Event: 5719 Source: NETLOGON
No Domain Controller is available for domain KFFF due to the following: There are currently no logon servers available to service the logon request. . Make sure that the computer is connected to the network and try again. If the problem persists, please contact your domain administrator.

Log: 'System' Date/Time: 06/02/2012 12:00:21 PM
Type: error Category: 0
Event: 5719 Source: NETLOGON
No Domain Controller is available for domain KFFF due to the following: There are currently no logon servers available to service the logon request. . Make sure that the computer is connected to the network and try again. If the problem persists, please contact your domain administrator.

Log: 'System' Date/Time: 06/02/2012 7:57:48 AM
Type: error Category: 0
Event: 7000 Source: Service Control Manager
The LogMeIn Kernel Information Provider service failed to start due to the following error: The system cannot find the path specified.

Log: 'System' Date/Time: 06/02/2012 7:57:48 AM
Type: error Category: 0
Event: 14325 Source: WMPNetworkSvc
Service 'WMPNetworkSvc' did not start correctly because QueryService encountered error '0x80004002'. In Windows Media Player, turn off media sharing, and then turn it back on.

Log: 'System' Date/Time: 06/02/2012 7:57:45 AM
Type: error Category: 0
Event: 5719 Source: NETLOGON
No Domain Controller is available for domain KFFF due to the following: There are currently no logon servers available to service the logon request. . Make sure that the computer is connected to the network and try again. If the problem persists, please contact your domain administrator.

Log: 'System' Date/Time: 06/02/2012 7:41:05 AM
Type: error Category: 0
Event: 7000 Source: Service Control Manager
The LogMeIn Kernel Information Provider service failed to start due to the following error: The system cannot find the path specified.

Application:

Vino's Event Viewer v01c run on Windows XP in English
Report run at 08/02/2012 7:46:50 AM

Note: All dates below are in the format dd/mm/yyyy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'Application' Date/Time: 08/02/2012 12:25:58 AM
Type: error Category: 0
Event: 15 Source: AutoEnrollment
Automatic certificate enrollment for local system failed to contact the active directory (0x8007054b). The specified domain either does not exist or could not be contacted. Enrollment will not be performed.

Log: 'Application' Date/Time: 07/02/2012 4:25:58 PM
Type: error Category: 0
Event: 15 Source: AutoEnrollment
Automatic certificate enrollment for local system failed to contact the active directory (0x8007054b). The specified domain either does not exist or could not be contacted. Enrollment will not be performed.

Log: 'Application' Date/Time: 07/02/2012 9:11:41 AM
Type: error Category: 0
Event: 1001 Source: Application Hang
Fault bucket 1180947459.

Log: 'Application' Date/Time: 07/02/2012 9:11:28 AM
Type: error Category: 101
Event: 1002 Source: Application Hang
Hanging application iexplore.exe, version 8.0.6001.18702, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Log: 'Application' Date/Time: 07/02/2012 8:23:49 AM
Type: error Category: 0
Event: 1054 Source: Userenv
Windows cannot obtain the domain controller name for your computer network. (The specified domain either does not exist or could not be contacted. ). Group Policy processing aborted.

Log: 'Application' Date/Time: 07/02/2012 8:23:48 AM
Type: error Category: 0
Event: 1521 Source: Userenv
Windows cannot locate the server copy of your roaming profile and is attempting to log you on with your local profile. Changes to the profile will not be copied to the server when you logoff. Possible causes of this error include network problems or insufficient security rights. If this problem persists, contact your network administrator. DETAIL - The network path was not found.

Log: 'Application' Date/Time: 07/02/2012 8:23:23 AM
Type: error Category: 0
Event: 15 Source: AutoEnrollment
Automatic certificate enrollment for local system failed to contact the active directory (0x8007054b). The specified domain either does not exist or could not be contacted. Enrollment will not be performed.

Log: 'Application' Date/Time: 07/02/2012 8:23:22 AM
Type: error Category: 0
Event: 1054 Source: Userenv
Windows cannot obtain the domain controller name for your computer network. (The specified domain either does not exist or could not be contacted. ). Group Policy processing aborted.

Log: 'Application' Date/Time: 07/02/2012 8:06:23 AM
Type: error Category: 0
Event: 1054 Source: Userenv
Windows cannot obtain the domain controller name for your computer network. (The specified domain either does not exist or could not be contacted. ). Group Policy processing aborted.

Log: 'Application' Date/Time: 07/02/2012 8:06:22 AM
Type: error Category: 0
Event: 1521 Source: Userenv
Windows cannot locate the server copy of your roaming profile and is attempting to log you on with your local profile. Changes to the profile will not be copied to the server when you logoff. Possible causes of this error include network problems or insufficient security rights. If this problem persists, contact your network administrator. DETAIL - The network path was not found.

Log: 'Application' Date/Time: 07/02/2012 3:15:49 AM
Type: error Category: 0
Event: 15 Source: AutoEnrollment
Automatic certificate enrollment for local system failed to contact the active directory (0x8007054b). The specified domain either does not exist or could not be contacted. Enrollment will not be performed.

Log: 'Application' Date/Time: 07/02/2012 3:15:48 AM
Type: error Category: 0
Event: 1054 Source: Userenv
Windows cannot obtain the domain controller name for your computer network. (The specified domain either does not exist or could not be contacted. ). Group Policy processing aborted.

Log: 'Application' Date/Time: 07/02/2012 12:00:19 AM
Type: error Category: 0
Event: 15 Source: AutoEnrollment
Automatic certificate enrollment for local system failed to contact the active directory (0x8007054b). The specified domain either does not exist or could not be contacted. Enrollment will not be performed.

Log: 'Application' Date/Time: 06/02/2012 4:00:19 PM
Type: error Category: 0
Event: 15 Source: AutoEnrollment
Automatic certificate enrollment for local system failed to contact the active directory (0x8007054b). The specified domain either does not exist or could not be contacted. Enrollment will not be performed.

Log: 'Application' Date/Time: 06/02/2012 8:10:11 AM
Type: error Category: 0
Event: 1001 Source: Application Hang
Fault bucket 734562961.

Log: 'Application' Date/Time: 06/02/2012 8:10:01 AM
Type: error Category: 101
Event: 1002 Source: Application Hang
Hanging application rundll32.exe, version 5.1.2600.5512, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Log: 'Application' Date/Time: 06/02/2012 8:07:58 AM
Type: error Category: 0
Event: 1001 Source: Application Hang
Fault bucket 1180947459.

Log: 'Application' Date/Time: 06/02/2012 8:07:42 AM
Type: error Category: 101
Event: 1002 Source: Application Hang
Hanging application iexplore.exe, version 8.0.6001.18702, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Log: 'Application' Date/Time: 06/02/2012 7:58:14 AM
Type: error Category: 0
Event: 1054 Source: Userenv
Windows cannot obtain the domain controller name for your computer network. (The specified domain either does not exist or could not be contacted. ). Group Policy processing aborted.

Log: 'Application' Date/Time: 06/02/2012 7:58:14 AM
Type: error Category: 0
Event: 1521 Source: Userenv
Windows cannot locate the server copy of your roaming profile and is attempting to log you on with your local profile. Changes to the profile will not be copied to the server when you logoff. Possible causes of this error include network problems or insufficient security rights. If this problem persists, contact your network administrator. DETAIL - The network path was not found.