Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Application not found error - sub folders pictures, video and music

Started by baddabing101 , Jul 26 2013 04:04 AM

Page 5 of 7
3
4
5
6
7

Please log in to reply

#61
baddabing101

Posted 02 August 2013 - 11:59 AM

Member

Topic Starter
Member
83 posts

Is there a desktop.ini in the main folder (go up one level)
If so right click and select copy
Then go to the subfolder right click and select paste

Then try to enter the sub folder normally

Yes there is. Pasted it into subfolder but no change.

#62
baddabing101

Posted 02 August 2013 - 12:01 PM

Member

Topic Starter
Member
83 posts

Copy the next line:

notepad C:\Users\Butler\Pictures\desktop.ini

Start, All Programs, Accessories, right click on Command Prompt and Run as Administrator, Continue. Right click and Paste or Edit then Paste and the copied line should appear.
Hit Enter. Notepad should open. Copy the text from notepad and paste it into a reply.

Ron

[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21779
InfoTip=@%SystemRoot%\system32\shell32.dll,-12688
IconResource=%SystemRoot%\system32\imageres.dll,-113
IconFile=%SystemRoot%\system32\shell32.dll
IconIndex=-236
[LocalizedFileNames]
Sample Pictures.lnk=@%SystemRoot%\system32\shell32.dll,-21805

#63
RKinner

Posted 02 August 2013 - 12:23 PM

Malware Expert

Expert
24,700 posts

These particular subfolders are funny things. They really contain folders from both your login and the public login so let's look at the public one too and also check for the files.

Copy the next lines:

dir %SystemRoot%\system32\shell32.dll > %userprofile%\desktop\junk.txt
dir %SystemRoot%\system32\imageres.dll >> %userprofile%\desktop\junk.txt
type %userprofile%\desktop\desktop.ini >> %userprofile%\desktop\junk.txt
type C:\Users\Public\Music\desktop.ini >> %userprofile%\desktop\junk.txt
type "C:\Users\Public\Music\Sample Music\desktop.ini" >> %userprofile%\desktop\junk.txt
type C:\Users\Paul\Music\desktop.ini >> %userprofile%\desktop\junk.txt
type "C:\Users\Paul\Music\Sample Music\desktop.ini" >> %userprofile%\desktop\junk.txt
type C:\Users\Pauly\Music\desktop.ini >> %userprofile%\desktop\junk.txt
type "C:\Users\Pauly\Music\Sample Music\desktop.ini" >> %userprofile%\desktop\junk.txt
type "C:\Users\Paul\Music\iTunes\iTunes Music\desktop.ini" >> %userprofile%\desktop\junk.txt

Start, All Programs, Accessories, right click on Command Prompt and Run as Administrator, Continue. Right click and Paste or Edit then Paste and the copied lines should appear.
Hit Enter. Notepad should open. Copy and paste the text from notepad into a reply.

Ron

#64
Essexboy

Posted 02 August 2013 - 12:36 PM

GeekU Moderator

Retired Staff
69,964 posts

Cheers Ron :thumbsup:

#65
baddabing101

Posted 02 August 2013 - 12:50 PM

Member

Topic Starter
Member
83 posts

These particular subfolders are funny things. They really contain folders from both your login and the public login so let's look at the public one too and also check for the files.

Copy the next lines:
dir %SystemRoot%\system32\shell32.dll > %userprofile%\desktop\junk.txt
dir %SystemRoot%\system32\imageres.dll >> %userprofile%\desktop\junk.txt
type %userprofile%\desktop\desktop.ini >> %userprofile%\desktop\junk.txt
type C:\Users\Public\Music\desktop.ini >> %userprofile%\desktop\junk.txt
type "C:\Users\Public\Music\Sample Music\desktop.ini" >> %userprofile%\desktop\junk.txt
type C:\Users\Paul\Music\desktop.ini >> %userprofile%\desktop\junk.txt
type "C:\Users\Paul\Music\Sample Music\desktop.ini" >> %userprofile%\desktop\junk.txt
type C:\Users\Pauly\Music\desktop.ini >> %userprofile%\desktop\junk.txt
type "C:\Users\Pauly\Music\Sample Music\desktop.ini" >> %userprofile%\desktop\junk.txt
type "C:\Users\Paul\Music\iTunes\iTunes Music\desktop.ini" >> %userprofile%\desktop\junk.txt
Start, All Programs, Accessories, right click on Command Prompt and Run as Administrator, Continue. Right click and Paste or Edit then Paste and the copied lines should appear.
Hit Enter. Notepad should open. Copy and paste the text from notepad into a reply.

Ron

notepad isn't opening.

This is what happens after I paste the lines into the command prompt box:

Microsoft Windows [Version 6.0.6002]
Copyright © 2006 Microsoft Corporation. All rights reserved.

C:\Windows\system32>dir %SystemRoot%\system32\shell32.dll > %userprofile%\deskto
p\junk.txt

C:\Windows\system32>dir %SystemRoot%\system32\imageres.dll >> %userprofile%\desk
top\junk.txt

C:\Windows\system32>type %userprofile%\desktop\desktop.ini >> %userprofile%\desk
top\junk.txt

C:\Windows\system32>type C:\Users\Public\Music\desktop.ini >> %userprofile%\desk
top\junk.txt

C:\Windows\system32>type "C:\Users\Public\Music\Sample Music\desktop.ini" >> %us
erprofile%\desktop\junk.txt

C:\Windows\system32>type C:\Users\Paul\Music\desktop.ini >> %userprofile%\deskto
p\junk.txt

C:\Windows\system32>type "C:\Users\Paul\Music\Sample Music\desktop.ini" >> %user
profile%\desktop\junk.txt
The system cannot find the path specified.

C:\Windows\system32>type C:\Users\Pauly\Music\desktop.ini >> %userprofile%\deskt
op\junk.txt
The system cannot find the path specified.

C:\Windows\system32>type "C:\Users\Pauly\Music\Sample Music\desktop.ini" >> %use
rprofile%\desktop\junk.txt
The system cannot find the path specified.

C:\Windows\system32>type "C:\Users\Paul\Music\iTunes\iTunes Music\desktop.ini" >
> %userprofile%\desktop\junk.txt

C:\Windows\system32>

#66
RKinner

Posted 02 August 2013 - 01:11 PM

Malware Expert

Expert
24,700 posts

Sorry, I left off the notepad line. Just double click junk.txt on your desktop.

#67
baddabing101

Posted 02 August 2013 - 01:13 PM

Member

Topic Starter
Member
83 posts

No problem at all. Thanks for the fast reply.

Volume in drive C is OS_Install
Volume Serial Number is 4437-0A3C

Directory of C:\Windows\system32

08/06/2012 18:47 11,586,048 shell32.dll
1 File(s) 11,586,048 bytes
0 Dir(s) 95,335,710,720 bytes free
Volume in drive C is OS_Install
Volume Serial Number is 4437-0A3C

Directory of C:\Windows\system32

02/11/2006 10:39 15,821,312 imageres.dll
1 File(s) 15,821,312 bytes
0 Dir(s) 95,335,710,720 bytes free

[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21769
IconResource=%SystemRoot%\system32\imageres.dll,-183

[LocalizedFileNames]

[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21803
InfoTip=@%SystemRoot%\system32\shell32.dll,-12689
IconResource=%SystemRoot%\system32\shell32.dll,-237
[.ShellClassInfo]
FolderType=MusicAlbum
MusicBuyUrl=http://redir.metaservices.microsoft.com/redir/buynow/?providerName=AMGClassical & Microsoft&albumID=208F236E-B511-4949-BDF9-3791602ED53A&a_id=%20&album=The%20Best%20of%20Beethoven&artistID=477FCAA1-EFC6-4D08-A81B-5286588E5407&p_id=%20&artist=Ludwig%20van%20Beethoven&locale=409&geoid=ffffffff&version=11.0.6001.7007&userlocale=809

[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21790
InfoTip=@%SystemRoot%\system32\shell32.dll,-12689
IconResource=%SystemRoot%\system32\imageres.dll,-108
IconFile=%SystemRoot%\system32\shell32.dll
IconIndex=-237
[LocalizedFileNames]
Sample Music.lnk=@%SystemRoot%\system32\shell32.dll,-21806
[.ShellClassInfo]
FolderType=MusicArtist
MusicBuyUrl=http://redir.metaservices.microsoft.com/redir/buynow/?providerName=AMG&albumID=3701CE11-BD77-4E75-9DB5-8B8F3013DE79&a_id=R%20%20%20528519&album=Yes%20Boss%20Food%20Corner&artistID=67624978-3431-4108-8F94-83721D2D22DB&p_id=P%20%20%20168549&artist=Transglobal%20Underground&locale=409&geoid=ffffffff&version=11.0.6002.18311&userlocale=809

#68
RKinner

Posted 02 August 2013 - 01:52 PM

Malware Expert

Expert
24,700 posts

That seems a deadend. The files are present and the FolderType=MusicAlbum. MusicBuyUrl= garbage is from Windows Media Player.

Now it's time for the heavy weapons. (Cue: Star Wars theme :lol:

)

download Process Monitor http://live.sysinter...com/Procmon.exe

Save it to your desktop. Run Process Monitor (right click and Run As Admin)

As soon as it starts, try to open one of the folders which is causing the problem. I'm going to assume it's videos if that's not right then change the following to the same name.

Then back at Process Monitor, File, then uncheck Capture Events. Once it stops,

Now click on Edit at the top of the page and then Find. Type in Videos then Find Next. Scroll it so the found line is at the top, then go down to the bottom of the page, hold down the shift key and click on the last line. That should highlight a full page of events.

File, Save, Highlighted Events, Format: Comma-Separated Values (CSV) then OK. It should save the file to logfile.csv which should be on your desktop. Close Process Monitor. Turn off P&P and zip up the logfile.csv and attach it to a Reply. (You can also just rename it to logfile.txt and attach it if you don't have 7-zip or winzip)

Hopefully the error will show up on this page. Otherwise we have to look at the full log which requires more work on both our parts.

Ron

#69
baddabing101

Posted 02 August 2013 - 02:14 PM

Member

Topic Starter
Member
83 posts

That seems a deadend. The files are present and the FolderType=MusicAlbum. MusicBuyUrl= garbage is from Windows Media Player.

Now it's time for the heavy weapons. (Cue: Star Wars theme )

download Process Monitor http://live.sysinter...com/Procmon.exe

Save it to your desktop. Run Process Monitor (right click and Run As Admin)

As soon as it starts, try to open one of the folders which is causing the problem. I'm going to assume it's videos if that's not right then change the following to the same name.

Then back at Process Monitor, File, then uncheck Capture Events. Once it stops,

Now click on Edit at the top of the page and then Find. Type in Videos then Find Next. Scroll it so the found line is at the top, then go down to the bottom of the page, hold down the shift key and click on the last line. That should highlight a full page of events.

File, Save, Highlighted Events, Format: Comma-Separated Values (CSV) then OK. It should save the file to logfile.csv which should be on your desktop. Close Process Monitor. Turn off P&P and zip up the logfile.csv and attach it to a Reply. (You can also just rename it to logfile.txt and attach it if you don't have 7-zip or winzip)

Hopefully the error will show up on this page. Otherwise we have to look at the full log which requires more work on both our parts.

Ron

Help me Obi-Wan Kenobi you're my only hope :rofl:

Attached Files

Logfile.zip 325.58KB 282 downloads

Edited by baddabing101, 02 August 2013 - 02:25 PM.

#70
RKinner

Posted 02 August 2013 - 04:17 PM

Malware Expert

Expert
24,700 posts

Following files were not found:

"C:\Program Files\Tuguu SL\Zipper\Zipper.exe"

"C:\Users\Paul\AppData\Local\Microsoft\Office\Groove\User\GFSConfig.xml"

"C:\Users\Paul\Pictures\2010-06-16\folder.gif"

"C:\Users\Paul\Pictures\2010-06-16\folder.jpg"

Only the top one can be considered an applications so that's my bet. .xml file is used to share your work with other employees so I think it's just something that is not used but they check on it anyway.

Let's try the top one. I'm thinking it might show up in ShellExView which you ran earlier. If instead of sorting it by company name you click once or twice on Microsoft which should be the third or fourth column header from the RIGHT, you should be able to get all of the NOs at the top. Do you see anything like zipper or Tuguu among the NOs? If so, click on it then click on the little red led looking symbol near the top left. This should disable it. Now close ShellExView and reboot then try to open the folder again. If you are still having the problem then run process monitor again as before and try and open your folder. This time Edit, Find and see if you can find zipper.exe.

If it's still there then try regseeker:

Get Regseeker:

http://www.hoverdesk.net/
Then click on Downloads
The downloads are at the bottom. I would use the bottom one where it says RegSeeker Portable 2.5 (.zip No installation. Just unzip in any folder)

http://www.hoverdesk...egSeeker25p.zip

(We do not want the Babylon toolbar!)

Download and Save (right click and Open Folder) then right click and Extract All. Extract. This will create a folder Regseeker25p. Inside it will be another Regseeker25p folder and in that will be the regseeker.exe which you need to right click on and Run As Administrator. Select Find in Registry.

Type: zipper.exe
in the Search For: box.)

Then click on Search! to the right of the box. Wait until it finishes which will take 10-15 minutes.

If it finds anything then Delete any of them that are associated with Tuguu SL.

I am curious why only the one folder is missing the folder.gif and folder.jpg. I hunted around in my Win 7 and only found the one folder.jpg in
C:\Users\Public\Music\Sample Music (which looks like C:\Users\Public\Public Music\Sample Music when you look at it in Explorer)

0/22/2011 01:23 PM 23,226 Folder.jpg

Turns out it's an album cover. So it's possible something about C:\Users\Paul\Pictures\2010-06-16\ makes it think it needs an album cover. If all else fails you might move C:\Users\Paul\Pictures\2010-06-16 to your desktop so it won't be involved.

Ron

#71
baddabing101

Posted 03 August 2013 - 07:10 AM

Member

Topic Starter
Member
83 posts

Following files were not found:

"C:\Program Files\Tuguu SL\Zipper\Zipper.exe"

"C:\Users\Paul\AppData\Local\Microsoft\Office\Groove\User\GFSConfig.xml"

"C:\Users\Paul\Pictures\2010-06-16\folder.gif"

"C:\Users\Paul\Pictures\2010-06-16\folder.jpg"

Only the top one can be considered an applications so that's my bet. .xml file is used to share your work with other employees so I think it's just something that is not used but they check on it anyway.

Let's try the top one. I'm thinking it might show up in ShellExView which you ran earlier. If instead of sorting it by company name you click once or twice on Microsoft which should be the third or fourth column header from the RIGHT, you should be able to get all of the NOs at the top. Do you see anything like zipper or Tuguu among the NOs? If so, click on it then click on the little red led looking symbol near the top left. This should disable it. Now close ShellExView and reboot then try to open the folder again. If you are still having the problem then run process monitor again as before and try and open your folder. This time Edit, Find and see if you can find zipper.exe.

If it's still there then try regseeker:

Get Regseeker:

http://www.hoverdesk.net/
Then click on Downloads
The downloads are at the bottom. I would use the bottom one where it says RegSeeker Portable 2.5 (.zip No installation. Just unzip in any folder)

http://www.hoverdesk...egSeeker25p.zip

(We do not want the Babylon toolbar!)

Download and Save (right click and Open Folder) then right click and Extract All. Extract. This will create a folder Regseeker25p. Inside it will be another Regseeker25p folder and in that will be the regseeker.exe which you need to right click on and Run As Administrator. Select Find in Registry.

Type: zipper.exe
in the Search For: box.)

Then click on Search! to the right of the box. Wait until it finishes which will take 10-15 minutes.

If it finds anything then Delete any of them that are associated with Tuguu SL.

I am curious why only the one folder is missing the folder.gif and folder.jpg. I hunted around in my Win 7 and only found the one folder.jpg in
C:\Users\Public\Music\Sample Music (which looks like C:\Users\Public\Public Music\Sample Music when you look at it in Explorer)

0/22/2011 01:23 PM 23,226 Folder.jpg

Turns out it's an album cover. So it's possible something about C:\Users\Paul\Pictures\2010-06-16\ makes it think it needs an album cover. If all else fails you might move C:\Users\Paul\Pictures\2010-06-16 to your desktop so it won't be involved.

Ron

Hi Ron,

I've attached a screenshot of the non microsoft files viewable in shellex. I can't see anything under tuguu. Maybe there is something else in there that could be disabled?

Thanks,

Paul.

Attached Thumbnails

Edited by baddabing101, 03 August 2013 - 07:11 AM.

#72
baddabing101

Posted 03 August 2013 - 07:22 AM

Member

Topic Starter
Member
83 posts

Think I've stumbled across something:

I just tried to do a search (click windows button and type into search) but it comes up with "windows explorer has stopped working" and then after that closes, another window opens saying "windows explorer is restarting". Task bar at the bottom disappears then comes back.

#73
RKinner

Posted 03 August 2013 - 08:57 AM

Malware Expert

Expert
24,700 posts

Are there any other programs in the ShellExView that are no longer installed?

1. Please download the Event Viewer Tool by Vino Rosso
http://images.malwar...om/vino/VEW.exe
and save it to your Desktop:
2. Right-click VEW.exe and Run AS Administrator
3. Under 'Select log to query', select:

* System
4. Under 'Select type to list', select:
* Error
* Warning

Then use the 'Number of events' as follows:

1. Click the radio button for 'Number of events'
Type 20 in the 1 to 20 box
Then click the Run button.
Notepad will open with the output log.

Please post the Output log in your next reply then repeat but select Application.

#74
baddabing101

Posted 03 August 2013 - 09:10 AM

Member

Topic Starter
Member
83 posts

Vino's Event Viewer v01c run on Windows Vista in English
Report run at 03/08/2013 16:09:37

Note: All dates below are in the format dd/mm/yyyy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 03/08/2013 11:59:12
Type: Error Category: 0
Event: 7022 Source: Service Control Manager
The HP CUE DeviceDiscovery Service service hung on starting.

Log: 'System' Date/Time: 02/08/2013 08:19:48
Type: Error Category: 0
Event: 7022 Source: Service Control Manager
The HP CUE DeviceDiscovery Service service hung on starting.

Log: 'System' Date/Time: 01/08/2013 17:23:23
Type: Error Category: 0
Event: 14 Source: volsnap
The shadow copies of volume C: were aborted because of an IO failure on volume C:.

Log: 'System' Date/Time: 01/08/2013 11:00:16
Type: Error Category: 0
Event: 14 Source: volsnap
The shadow copies of volume C: were aborted because of an IO failure on volume C:.

Log: 'System' Date/Time: 01/08/2013 07:32:10
Type: Error Category: 0
Event: 7031 Source: Service Control Manager
The avast! Antivirus service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.

Log: 'System' Date/Time: 01/08/2013 07:32:04
Type: Error Category: 0
Event: 7022 Source: Service Control Manager
The HP CUE DeviceDiscovery Service service hung on starting.

Log: 'System' Date/Time: 31/07/2013 17:10:44
Type: Error Category: 0
Event: 14 Source: volsnap
The shadow copies of volume C: were aborted because of an IO failure on volume C:.

Log: 'System' Date/Time: 31/07/2013 07:59:13
Type: Error Category: 0
Event: 7031 Source: Service Control Manager
The avast! Antivirus service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.

Log: 'System' Date/Time: 31/07/2013 07:59:07
Type: Error Category: 0
Event: 7022 Source: Service Control Manager
The HP CUE DeviceDiscovery Service service hung on starting.

Log: 'System' Date/Time: 30/07/2013 11:57:24
Type: Error Category: 0
Event: 7000 Source: Service Control Manager
The Steam Client Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

Log: 'System' Date/Time: 30/07/2013 11:57:24
Type: Error Category: 0
Event: 7009 Source: Service Control Manager
A timeout was reached (30000 milliseconds) while waiting for the Steam Client Service service to connect.

Log: 'System' Date/Time: 30/07/2013 09:57:30
Type: Error Category: 0
Event: 14 Source: volsnap
The shadow copies of volume C: were aborted because of an IO failure on volume C:.

Log: 'System' Date/Time: 30/07/2013 08:22:14
Type: Error Category: 0
Event: 7031 Source: Service Control Manager
The avast! Antivirus service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.

Log: 'System' Date/Time: 30/07/2013 08:22:09
Type: Error Category: 0
Event: 7022 Source: Service Control Manager
The HP CUE DeviceDiscovery Service service hung on starting.

Log: 'System' Date/Time: 29/07/2013 16:53:56
Type: Error Category: 0
Event: 14 Source: volsnap
The shadow copies of volume C: were aborted because of an IO failure on volume C:.

Log: 'System' Date/Time: 29/07/2013 08:03:51
Type: Error Category: 0
Event: 7031 Source: Service Control Manager
The avast! Antivirus service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.

Log: 'System' Date/Time: 29/07/2013 08:03:46
Type: Error Category: 0
Event: 7022 Source: Service Control Manager
The HP CUE DeviceDiscovery Service service hung on starting.

Log: 'System' Date/Time: 27/07/2013 09:45:10
Type: Error Category: 0
Event: 7031 Source: Service Control Manager
The avast! Antivirus service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.

Log: 'System' Date/Time: 27/07/2013 09:44:51
Type: Error Category: 0
Event: 7022 Source: Service Control Manager
The HP CUE DeviceDiscovery Service service hung on starting.

Log: 'System' Date/Time: 26/07/2013 21:46:51
Type: Error Category: 0
Event: 14 Source: volsnap
The shadow copies of volume C: were aborted because of an IO failure on volume C:.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Warning Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 02/08/2013 18:19:19
Type: Warning Category: 0
Event: 1006 Source: Microsoft-Windows-Windows Defender
Windows Defender scan has detected spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft....threatid=198788 Scan ID: {93B509D1-E898-4061-A980-24C07ECCC64F} Scan Type: AntiSpyware Scan Parameters: Full Scan User: NT AUTHORITY\NETWORK SERVICE Name: Adware:Win32/WebCake ID: 198788 Severity ID: 2 Category ID: 1 Path Found: file:C:\Users\Paul\AppData\Local\Temp\DIQM\Zipper_199\software\Webcake.exe;file:C:\Users\Paul\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HQT5BVEZ\WebCakesetup[1].exe Detection Type: Concrete

Log: 'System' Date/Time: 01/08/2013 20:43:38
Type: Warning Category: 0
Event: 4001 Source: Microsoft-Windows-WLAN-AutoConfig
WLAN AutoConfig service has successfully stopped.

Log: 'System' Date/Time: 31/07/2013 20:24:27
Type: Warning Category: 0
Event: 4001 Source: Microsoft-Windows-WLAN-AutoConfig
WLAN AutoConfig service has successfully stopped.

Log: 'System' Date/Time: 30/07/2013 20:13:02
Type: Warning Category: 0
Event: 1006 Source: Microsoft-Windows-Windows Defender
Windows Defender scan has detected spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft....threatid=198788 Scan ID: {0CE07C9F-B2E7-408A-B536-74F925F8752F} Scan Type: AntiSpyware Scan Parameters: Full Scan User: NT AUTHORITY\NETWORK SERVICE Name: Adware:Win32/WebCake ID: 198788 Severity ID: 2 Category ID: 1 Path Found: file:C:\Users\Paul\AppData\Local\Temp\DIQM\Zipper_199\software\Webcake.exe;file:C:\Users\Paul\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HQT5BVEZ\WebCakesetup[1].exe Detection Type: Concrete

Log: 'System' Date/Time: 29/07/2013 20:56:11
Type: Warning Category: 0
Event: 4001 Source: Microsoft-Windows-WLAN-AutoConfig
WLAN AutoConfig service has successfully stopped.

Log: 'System' Date/Time: 28/07/2013 10:25:46
Type: Warning Category: 0
Event: 4001 Source: Microsoft-Windows-WLAN-AutoConfig
WLAN AutoConfig service has successfully stopped.

Log: 'System' Date/Time: 28/07/2013 09:43:23
Type: Warning Category: 0
Event: 36 Source: Microsoft-Windows-Time-Service
The time service has not synchronized the system time for 86400 seconds because none of the time service providers provided a usable time stamp. The time service will not update the local system time until it is able to synchronize with a time source. If the local system is configured to act as a time server for clients, it will stop advertising as a time source to clients. The time service will continue to retry and sync time with its time sources. Check system event log for other W32time events for more details. Run 'w32tm /resync' to force an instant time synchronization.

Log: 'System' Date/Time: 28/07/2013 03:45:28
Type: Warning Category: 0
Event: 1006 Source: Microsoft-Windows-Windows Defender
Windows Defender scan has detected spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft....threatid=198788 Scan ID: {79108A3A-1729-4BBB-B6E0-EEC28C6C3199} Scan Type: AntiSpyware Scan Parameters: Full Scan User: NT AUTHORITY\NETWORK SERVICE Name: Adware:Win32/WebCake ID: 198788 Severity ID: 2 Category ID: 1 Path Found: file:C:\Users\Paul\AppData\Local\Temp\DIQM\Zipper_199\software\Webcake.exe;file:C:\Users\Paul\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HQT5BVEZ\WebCakesetup[1].exe Detection Type: Concrete

Log: 'System' Date/Time: 26/07/2013 11:41:18
Type: Warning Category: 0
Event: 4001 Source: Microsoft-Windows-WLAN-AutoConfig
WLAN AutoConfig service has successfully stopped.

Log: 'System' Date/Time: 26/07/2013 01:52:52
Type: Warning Category: 0
Event: 4001 Source: Microsoft-Windows-WLAN-AutoConfig
WLAN AutoConfig service has successfully stopped.

Log: 'System' Date/Time: 26/07/2013 01:46:55
Type: Warning Category: 0
Event: 4001 Source: Microsoft-Windows-WLAN-AutoConfig
WLAN AutoConfig service has successfully stopped.

Log: 'System' Date/Time: 26/07/2013 00:43:33
Type: Warning Category: 0
Event: 4001 Source: Microsoft-Windows-WLAN-AutoConfig
WLAN AutoConfig service has successfully stopped.

Log: 'System' Date/Time: 25/07/2013 22:36:32
Type: Warning Category: 0
Event: 4001 Source: Microsoft-Windows-WLAN-AutoConfig
WLAN AutoConfig service has successfully stopped.

Log: 'System' Date/Time: 25/07/2013 19:52:56
Type: Warning Category: 0
Event: 263 Source: PlugPlayManager
The service 'TabletInputService' may not have unregistered for device event notifications before it was stopped.

Log: 'System' Date/Time: 25/07/2013 19:41:23
Type: Warning Category: 0
Event: 4001 Source: Microsoft-Windows-WLAN-AutoConfig
WLAN AutoConfig service has successfully stopped.

Log: 'System' Date/Time: 25/07/2013 18:57:41
Type: Warning Category: 0
Event: 4001 Source: Microsoft-Windows-WLAN-AutoConfig
WLAN AutoConfig service has successfully stopped.

Log: 'System' Date/Time: 25/07/2013 18:49:44
Type: Warning Category: 0
Event: 4001 Source: Microsoft-Windows-WLAN-AutoConfig
WLAN AutoConfig service has successfully stopped.

Log: 'System' Date/Time: 25/07/2013 18:40:37
Type: Warning Category: 0
Event: 4001 Source: Microsoft-Windows-WLAN-AutoConfig
WLAN AutoConfig service has successfully stopped.

Log: 'System' Date/Time: 25/07/2013 18:19:24
Type: Warning Category: 0
Event: 1002 Source: Microsoft-Windows-Windows Defender
Windows Defender scan has been stopped before completion. Scan ID: {E3854568-AA8F-4E6D-8518-CCBC389C94FC} Scan Type: AntiSpyware Scan Parameters: Full Scan User: NT AUTHORITY\NETWORK SERVICE

Log: 'System' Date/Time: 25/07/2013 18:06:51
Type: Warning Category: 0
Event: 129 Source: nvstor32
Reset to device, \Device\RaidPort0, was issued.

#75
baddabing101

Posted 03 August 2013 - 09:12 AM

Member

Topic Starter
Member
83 posts

Vino's Event Viewer v01c run on Windows Vista in English
Report run at 03/08/2013 16:11:53

Note: All dates below are in the format dd/mm/yyyy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'Application' Date/Time: 03/08/2013 13:19:57
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application Explorer.EXE, version 6.0.6002.18005, time stamp 0x49e01da5, faulting module SHELL32.dll, version 6.0.6002.18646, time stamp 0x4fd23a92, exception code 0xc0000005, fault offset 0x000c9f04, process id 0x1050, application start time 0x01ce904bd0c24ce4.

Log: 'Application' Date/Time: 03/08/2013 13:17:27
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application Explorer.EXE, version 6.0.6002.18005, time stamp 0x49e01da5, faulting module SHELL32.dll, version 6.0.6002.18646, time stamp 0x4fd23a92, exception code 0xc0000005, fault offset 0x000c9f04, process id 0x1488, application start time 0x01ce904bbc4d2dc4.

Log: 'Application' Date/Time: 03/08/2013 13:16:53
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application Explorer.EXE, version 6.0.6002.18005, time stamp 0x49e01da5, faulting module SHELL32.dll, version 6.0.6002.18646, time stamp 0x4fd23a92, exception code 0xc0000005, fault offset 0x000c9f04, process id 0x17b4, application start time 0x01ce904bb1879c44.

Log: 'Application' Date/Time: 03/08/2013 13:16:34
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application Explorer.EXE, version 6.0.6002.18005, time stamp 0x49e01da5, faulting module SHELL32.dll, version 6.0.6002.18646, time stamp 0x4fd23a92, exception code 0xc0000005, fault offset 0x000c9f04, process id 0xf70, application start time 0x01ce90424f0d4734.

Log: 'Application' Date/Time: 02/08/2013 20:16:57
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application iTunes.exe, version 11.0.4.4, time stamp 0x51a8f09f, faulting module iTunes.dll, version 11.0.4.4, time stamp 0x51a8f090, exception code 0xc0000005, fault offset 0x005f2993, process id 0x13d4, application start time 0x01ce8fa83e111e30.

Log: 'Application' Date/Time: 01/08/2013 15:20:52
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application firefox.exe, version 22.0.0.4917, time stamp 0x51c06b1b, faulting module xul.dll, version 22.0.0.4917, time stamp 0x51c06a5b, exception code 0xc0000005, fault offset 0x00173668, process id 0x408, application start time 0x01ce8eb82e6bfe62.

Log: 'Application' Date/Time: 01/08/2013 10:59:44
Type: Error Category: 0
Event: 11500 Source: MsiInstaller
Product: Java 7 Update 25 -- Error 1500.Another installation is in progress. You must complete that installation before continuing this one.

Log: 'Application' Date/Time: 31/07/2013 19:14:13
Type: Error Category: 101
Event: 1002 Source: Application Hang
The program Steam.exe version 1.84.85.72 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: 173c Start Time: 01ce8dc9fa713da8 Termination Time: 1641

Log: 'Application' Date/Time: 30/07/2013 12:38:50
Type: Error Category: 0
Event: 100 Source: Bonjour Service
Task Scheduling Error: m->NextScheduledSPRetry 31715

Log: 'Application' Date/Time: 30/07/2013 12:38:50
Type: Error Category: 0
Event: 100 Source: Bonjour Service
Task Scheduling Error: m->NextScheduledEvent 31715

Log: 'Application' Date/Time: 30/07/2013 12:38:50
Type: Error Category: 0
Event: 100 Source: Bonjour Service
Task Scheduling Error: Continuously busy for more than a second

Log: 'Application' Date/Time: 30/07/2013 12:38:49
Type: Error Category: 0
Event: 100 Source: Bonjour Service
Task Scheduling Error: m->NextScheduledSPRetry 30716

Log: 'Application' Date/Time: 30/07/2013 12:38:49
Type: Error Category: 0
Event: 100 Source: Bonjour Service
Task Scheduling Error: m->NextScheduledEvent 30716

Log: 'Application' Date/Time: 30/07/2013 12:38:49
Type: Error Category: 0
Event: 100 Source: Bonjour Service
Task Scheduling Error: Continuously busy for more than a second

Log: 'Application' Date/Time: 30/07/2013 12:38:48
Type: Error Category: 0
Event: 100 Source: Bonjour Service
Task Scheduling Error: m->NextScheduledSPRetry 29702

Log: 'Application' Date/Time: 30/07/2013 12:38:48
Type: Error Category: 0
Event: 100 Source: Bonjour Service
Task Scheduling Error: m->NextScheduledEvent 29702

Log: 'Application' Date/Time: 30/07/2013 12:38:48
Type: Error Category: 0
Event: 100 Source: Bonjour Service
Task Scheduling Error: Continuously busy for more than a second

Log: 'Application' Date/Time: 30/07/2013 12:38:47
Type: Error Category: 0
Event: 100 Source: Bonjour Service
Task Scheduling Error: m->NextScheduledSPRetry 28704

Log: 'Application' Date/Time: 30/07/2013 12:38:47
Type: Error Category: 0
Event: 100 Source: Bonjour Service
Task Scheduling Error: m->NextScheduledEvent 28704

Log: 'Application' Date/Time: 30/07/2013 12:38:47
Type: Error Category: 0
Event: 100 Source: Bonjour Service
Task Scheduling Error: Continuously busy for more than a second

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Warning Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'Application' Date/Time: 03/08/2013 00:37:51
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 1 user registry handles leaked from \Registry\User\S-1-5-21-2530541613-2360021890-2058245127-1000_Classes:
Process 1988 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

Log: 'Application' Date/Time: 03/08/2013 00:37:50
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 10 user registry handles leaked from \Registry\User\S-1-5-21-2530541613-2360021890-2058245127-1000:
Process 1064 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000
Process 1988 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software\Policies
Process 1064 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software\Policies\Microsoft\SystemCertificates
Process 1988 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software
Process 1064 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software\Microsoft\SystemCertificates\Root
Process 1988 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Process 1988 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 1988 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN
Process 1064 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software\Microsoft\SystemCertificates\trust
Process 1064 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software\Microsoft\SystemCertificates\SmartCardRoot

Log: 'Application' Date/Time: 01/08/2013 20:43:00
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 5 user registry handles leaked from \Registry\User\S-1-5-21-2530541613-2360021890-2058245127-1000:
Process 1928 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software\Policies
Process 1928 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software
Process 1928 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Process 1928 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 1928 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN

Log: 'Application' Date/Time: 31/07/2013 20:23:50
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 1 user registry handles leaked from \Registry\User\S-1-5-21-2530541613-2360021890-2058245127-1000_Classes:
Process 1940 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

Log: 'Application' Date/Time: 31/07/2013 20:23:48
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 5 user registry handles leaked from \Registry\User\S-1-5-21-2530541613-2360021890-2058245127-1000:
Process 1940 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software\Policies
Process 1940 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software
Process 1940 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Process 1940 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 1940 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN

Log: 'Application' Date/Time: 30/07/2013 20:55:48
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 1 user registry handles leaked from \Registry\User\S-1-5-21-2530541613-2360021890-2058245127-1000_Classes:
Process 1972 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

Log: 'Application' Date/Time: 30/07/2013 20:55:45
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 5 user registry handles leaked from \Registry\User\S-1-5-21-2530541613-2360021890-2058245127-1000:
Process 1972 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software\Policies
Process 1972 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software
Process 1972 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Process 1972 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 1972 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN

Log: 'Application' Date/Time: 29/07/2013 20:55:36
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 1 user registry handles leaked from \Registry\User\S-1-5-21-2530541613-2360021890-2058245127-1000_Classes:
Process 2000 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

Log: 'Application' Date/Time: 29/07/2013 20:55:36
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 5 user registry handles leaked from \Registry\User\S-1-5-21-2530541613-2360021890-2058245127-1000:
Process 2000 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software\Policies
Process 2000 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software
Process 2000 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Process 2000 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 2000 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN

Log: 'Application' Date/Time: 28/07/2013 10:25:21
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 1 user registry handles leaked from \Registry\User\S-1-5-21-2530541613-2360021890-2058245127-1000_Classes:
Process 1924 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

Log: 'Application' Date/Time: 27/07/2013 00:28:29
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 1 user registry handles leaked from \Registry\User\S-1-5-21-2530541613-2360021890-2058245127-1000_Classes:
Process 1980 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

Log: 'Application' Date/Time: 26/07/2013 19:34:44
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 1 user registry handles leaked from \Registry\User\S-1-5-21-2530541613-2360021890-2058245127-1000_Classes:
Process 1904 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

Log: 'Application' Date/Time: 26/07/2013 11:41:04
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 1 user registry handles leaked from \Registry\User\S-1-5-21-2530541613-2360021890-2058245127-1000_Classes:
Process 1936 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

Log: 'Application' Date/Time: 26/07/2013 10:51:43
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 1 user registry handles leaked from \Registry\User\S-1-5-21-2530541613-2360021890-2058245127-1000_Classes:
Process 1940 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

Log: 'Application' Date/Time: 26/07/2013 10:51:41
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 7 user registry handles leaked from \Registry\User\S-1-5-21-2530541613-2360021890-2058245127-1000:
Process 1940 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software\Policies
Process 5004 (\Device\HarddiskVolume2\Windows\System32\msiexec.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software\Microsoft\Windows\CurrentVersion\Explorer
Process 1940 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software
Process 1940 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Process 5004 (\Device\HarddiskVolume2\Windows\System32\msiexec.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts
Process 1940 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 1940 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN

Log: 'Application' Date/Time: 26/07/2013 10:46:54
Type: Warning Category: 0
Event: 10010 Source: Microsoft-Windows-RestartManager
Application 'C:\Program Files\Common Files\Apple\Mobile Device Support\SyncServer.exe' (pid 6020) cannot be restarted - Application SID does not match Conductor SID..

Log: 'Application' Date/Time: 26/07/2013 09:36:21
Type: Warning Category: 3
Event: 3036 Source: Microsoft-Windows-Search
The content source <csc://{s-1-5-21-2530541613-2360021890-2058245127-1000}/> cannot be accessed.

Context: Application, SystemIndex Catalog

Details:
Unspecified error (0x80004005)

Log: 'Application' Date/Time: 26/07/2013 01:52:51
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 1 user registry handles leaked from \Registry\User\S-1-5-21-2530541613-2360021890-2058245127-1000_Classes:
Process 1936 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

Log: 'Application' Date/Time: 26/07/2013 01:46:40
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 1 user registry handles leaked from \Registry\User\S-1-5-21-2530541613-2360021890-2058245127-1000_Classes:
Process 1968 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

Log: 'Application' Date/Time: 26/07/2013 01:00:59
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 1 user registry handles leaked from \Registry\User\S-1-5-21-2530541613-2360021890-2058245127-1000_Classes:
Process 2008 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-2530541613-2360021890-2058245127-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache