computer crashing/help sponge

[Mr. Sandman]

On Sat, 13 Sep 2003 16:57:27 +0300, Lance Delacroix
<lance_delacroix@fastmail.fm> wrote:


>ANY new web page, or specific web pages?

No specific or new web pages. It appears too be a random event.

Aside from the other posters(?) advice, it could well be a
virus/trojan, one that your anti-virus software doesn't recognize.

I'm also thinking it may have to do with your system's being able to
access the net. Have you allowed SVCHOST.EXE to access the net thru
Kerio?

Sponge
Sponge's Anti-Spyware Source
www.geocities.com/yosponge

I don't appear too have a rule for SVCHOST.EXE. Also I haven't had the
problem yet since I disabled the automatic reboot feature. But since
this was a random experience I will give it some more time. I will
also add a rule for the above file.

[Lance Delacroix]

On Sat, 13 Sep 2003 15:14:02 GMT, Mr. Sandman <IBEW_Wireman@union.yes>
prounounced a fatwah thus:

>On Sat, 13 Sep 2003 16:57:27 +0300, Lance Delacroix
><lance_delacroix@fastmail.fm> wrote:
>
>
>>ANY new web page, or specific web pages?
>
>No specific or new web pages. It appears too be a random event.

Try using Mozilla instead of K-meleon and see what happens. I think I
had wierd probs with K-m, too. Finally stopped using it.

[Mr. Sandman]

On Sun, 14 Sep 2003 12:54:26 +0300, Lance Delacroix
<lance_delacroix@fastmail.fm> wrote:

>On Sat, 13 Sep 2003 15:14:02 GMT, Mr. Sandman <IBEW_Wireman@union.yes>
>prounounced a fatwah thus:
>
>>On Sat, 13 Sep 2003 16:57:27 +0300, Lance Delacroix
>><lance_delacroix@fastmail.fm> wrote:
>>
>>
>>>ANY new web page, or specific web pages?
>>
>>No specific or new web pages. It appears too be a random event.
>
>Try using Mozilla instead of K-meleon and see what happens. I think I
>had wierd probs with K-m, too. Finally stopped using it.

I just crashed again, took quite a while, like I said this has been a
random event. Dont think changing browsers is the answer as this has
happened with different browsers. I think it is in the networking
congig.

[sponge]

On Sat, 13 Sep 2003 15:14:02 GMT, Mr. Sandman <IBEW_Wireman@union.yes>
wrote:

How's your disk space? Windows gets real screwy when it gets low on
disk space. And even half a gig is low by Windows standards. You can
run scandisk (or whatever the equivalent is in XP) to check it out;
sometimes you have a lot less than the OS reports.

If that doesn't work, try shutting off the firewall for a bit. You can
disable it from running at startup from the Adminstration - >
Miscellaneous menu. This and the NetBIOS config is the only thing from
my page that could potentially cause a system crash or reboot (short
of something extraordinary, like a bad file write.)

I'm also curious to know what you have running. Get HiJackThis! to
find out and post a log here.

Sponge
Sponge's Anti-Spyware Source
www.geocities.com/yosponge

[Mr. Sandman]

On 14 Sep 2003 16:04:42 -0700, yosponge@yahoo.com (sponge) wrote:

>On Sat, 13 Sep 2003 15:14:02 GMT, Mr. Sandman <IBEW_Wireman@union.yes>
>wrote:
>
>How's your disk space? Windows gets real screwy when it gets low on
>disk space. And even half a gig is low by Windows standards. You can
>run scandisk (or whatever the equivalent is in XP) to check it out;
>sometimes you have a lot less than the OS reports.
>
>If that doesn't work, try shutting off the firewall for a bit. You can
>disable it from running at startup from the Adminstration - >
>Miscellaneous menu. This and the NetBIOS config is the only thing from
>my page that could potentially cause a system crash or reboot (short
>of something extraordinary, like a bad file write.)
>
>I'm also curious to know what you have running. Get HiJackThis! to
>find out and post a log here.
>
>Sponge
>Sponge's Anti-Spyware Source
>www.geocities.com/yosponge

First of all thank you for taking the time too help me try and figure
this out. I am pretty much a newbie but am trying too learn. I have
17.7GB of hard drive space. It is a confusing problem because it is so
random. Thank you again for any help.

Logfile of HijackThis v1.96.0
Scan saved at 7:50:44 PM, on 9/14/2003
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Kerio\Personal Firewall\persfw.exe
C:\WINDOWS\System32\PGPsdkServ.exe
C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\ICO.EXE
C:\Program Files\DU Meter\DUMeter.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\DELL\Drivers\R34790\Mouse\SETUP\MSH\Mouse\point 32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Zero Knowledge\Freedom\Freedom.exe
C:\Program Files\Evidence Eliminator\ee.exe
C:\Program Files\PGP Corporation\PGP for Windows XP\PGPtray.exe
C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
C:\Program Files\Pyrenean\DNSKong\DNSKong.exe
C:\Program Files\Silicon Prairie Software\MemTurbo\memturbo.exe
C:\Program Files\Proxomitron Naoko-4\Proxomitron.exe
C:\Program Files\Agent\agent.exe
C:\Documents and Settings\d and l\My
Documents\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
http://www.microsoft.com/isapi/redir...ie&ar=iesearch
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.insightbb.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.insightbb.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://www.microsoft.com/isapi/redir...ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://www.microsoft.com/isapi/redir...r=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL
= http://www.microsoft.com/isapi/redir...ie&ar=iesearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant
= about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title =
IBEW
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet
Settings,ProxyServer =
ftp=127.0.0.1:8080;gopher=127.0.0.1:8080;http=127. 0.0.1:8080;https=127.0.0.1:8080;socks=127.0.0.1:80 80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet
Settings,ProxyOverride = <local>
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page =
http://www.microsoft.com/isapi/redir...e5update&O1=b1
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
N3 - Netscape 7: user_pref("browser.startup.homepage",
"http://home.netscape.com/bookmark/7_0/home.html"); (C:\Documents and
Settings\d and l\Application
Data\Mozilla\Profiles\default\yxchk98c.slt\prefs.j s)
N3 - Netscape 7: user_pref("browser.search.defaultengine",
"engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csea rchplugins%5CSBWeb_01.src");
(C:\Documents and Settings\d and l\Application
Data\Mozilla\Profiles\default\yxchk98c.slt\prefs.j s)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -
C:\PROGRA~1\SPYBOT~2\SDHelper.dll
O2 - BHO: Freedom BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} -
C:\Program Files\Zero Knowledge\Freedom\freebhor.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} -
C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus -
{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton
SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0
-k
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH
Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE
C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [POINTER]
C:\DELL\Drivers\R34790\Mouse\SETUP\MSH\Mouse\point 32.exe
O4 - HKLM\..\Run: [QD FastAndSafe] C:\My Shared Folder\software\Norton
SystemWorks 2003-Retail\norton\FASTSAFE\QDCSFS.exe /startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec
Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec
Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
/STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O4 - HKLM\..\Run: [AVG7_RegCleaner]
C:\PROGRA~1\Grisoft\AVG7\avgregcl.exe /BOOT
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe"
/background
O4 - HKCU\..\Run: [Zero Knowledge Freedom] C:\Program Files\Zero
Knowledge\Freedom\Freedom.exe
O4 - HKCU\..\Run: [Evidence Eliminator] C:\Program Files\Evidence
Eliminator\ee.exe /m
O4 - HKCU\..\Run: [Desktop Weather 3] C:\Program Files\The Weather
Channel\The Weather Channel.exe
O4 - Startup: DNSKong.lnk = C:\Program
Files\Pyrenean\DNSKong\DNSKong.exe
O4 - Startup: MemTurbo.lnk = C:\Program Files\Silicon Prairie
Software\MemTurbo\memturbo.exe
O4 - Startup: proxomitron.lnk = C:\Program Files\Proxomitron
Naoko-4\Proxomitron.exe
O4 - Global Startup: PGPtray.lnk = ?
O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone
Labs\ZoneAlarm\zonealarm.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions
present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel
present
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet
Explorer\Plugins\NPDocBox.dll
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -
http://v4.windowsupdate.microsoft.co...?1059844265546
O17 -
HKLM\System\CCS\Services\Tcpip\..\{5F3482F9-45D5-46AB-86E7-AFA29D8F6707}:
NameServer =
127.0.0.1,63.240.76.5,204.127.202.5,204.127.198.5, 216.148.227.75

[YoKenny]

Mr. Sandman wrote:
> On 14 Sep 2003 16:04:42 -0700, yosponge@yahoo.com (sponge) wrote:
>> On Sat, 13 Sep 2003 15:14:02 GMT, Mr. Sandman
>> <IBEW_Wireman@union.yes>
>> wrote:
>>
>> How's your disk space? Windows gets real screwy when it gets low on
>> disk space. And even half a gig is low by Windows standards. You can
>> run scandisk (or whatever the equivalent is in XP) to check it out;
>> sometimes you have a lot less than the OS reports.
>>
>> If that doesn't work, try shutting off the firewall for a bit. You
>> can
>> disable it from running at startup from the Adminstration - >
>> Miscellaneous menu. This and the NetBIOS config is the only thing
>> from
>> my page that could potentially cause a system crash or reboot (short
>> of something extraordinary, like a bad file write.)
>>
>> I'm also curious to know what you have running. Get HiJackThis! to
>> find out and post a log here.
>>
>> Sponge
>> Sponge's Anti-Spyware Source
>> www.geocities.com/yosponge
>
> First of all thank you for taking the time too help me try and figure
> this out. I am pretty much a newbie but am trying too learn. I have
> 17.7GB of hard drive space. It is a confusing problem because it is so
> random. Thank you again for any help.

Looks like you are running two anti virus applications and two firewalls
plus Evidence Eliminator. (spit) Also looks like a RAM optimizer as well.
No wonder you are having problems.
http://badtux.org/eesucks/index.html

I hear that Norton System (doesn't)Works causes more crashes than it
prevents.

Get rid of memturbo.exe. Do a Google Group search to see the problems it
causes.

Run only one firewall and one anti virus application.

Hope you have lots of RAM and a fast processor as this system must run like
a 200MHZ P1.

> Logfile of HijackThis v1.96.0
> Scan saved at 7:50:44 PM, on 9/14/2003
> Platform: Windows XP SP1 (WinNT 5.01.2600)
> MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
>
> Running processes:
> C:\WINDOWS\System32\smss.exe
> C:\WINDOWS\system32\winlogon.exe
> C:\WINDOWS\system32\services.exe
> C:\WINDOWS\system32\lsass.exe
> C:\WINDOWS\system32\svchost.exe
> C:\WINDOWS\System32\svchost.exe
> C:\WINDOWS\system32\spoolsv.exe
> C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
> C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
> C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
> C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
> C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
> C:\WINDOWS\System32\nvsvc32.exe
> C:\Program Files\Kerio\Personal Firewall\persfw.exe
> C:\WINDOWS\System32\PGPsdkServ.exe
> C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
> C:\WINDOWS\System32\svchost.exe
> C:\WINDOWS\system32\ZoneLabs\vsmon.exe
> C:\WINDOWS\System32\MsPMSPSv.exe
> C:\WINDOWS\Explorer.EXE
> C:\WINDOWS\System32\ICO.EXE
> C:\Program Files\DU Meter\DUMeter.exe
> C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
> C:\DELL\Drivers\R34790\Mouse\SETUP\MSH\Mouse\point 32.exe
> C:\Program Files\Common Files\Real\Update_OB\realsched.exe
> C:\Program Files\Common Files\Symantec Shared\ccApp.exe
> C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
> C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
> C:\Program Files\Messenger\msmsgs.exe
> C:\Program Files\Zero Knowledge\Freedom\Freedom.exe
> C:\Program Files\Evidence Eliminator\ee.exe
> C:\Program Files\PGP Corporation\PGP for Windows XP\PGPtray.exe
> C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
> C:\Program Files\Pyrenean\DNSKong\DNSKong.exe
> C:\Program Files\Silicon Prairie Software\MemTurbo\memturbo.exe
> C:\Program Files\Proxomitron Naoko-4\Proxomitron.exe
> C:\Program Files\Agent\agent.exe
> C:\Documents and Settings\d and l\My
> Documents\hijackthis\HijackThis.exe
>
> R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
> http://www.microsoft.com/isapi/redir...ie&ar=iesearch
> R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
> http://www.insightbb.com/
> R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
> http://www.insightbb.com
> R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
> http://www.microsoft.com/isapi/redir...ie&ar=iesearch
> R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
> http://www.microsoft.com/isapi/redir...r=6&ar=msnhome
> R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL
> = http://www.microsoft.com/isapi/redir...ie&ar=iesearch
> R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant
> = about:blank
> R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title =
> IBEW
> R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet
> Settings,ProxyServer =
>
ftp=127.0.0.1:8080;gopher=127.0.0.1:8080;http=127. 0.0.1:8080;https=127.0.0.1
:8080;socks=127.0.0.1:8080
> R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet
> Settings,ProxyOverride = <local>
> R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page =
>
http://www.microsoft.com/isapi/redir...e5update&O1=b1
> R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
> N3 - Netscape 7: user_pref("browser.startup.homepage",
> "http://home.netscape.com/bookmark/7_0/home.html"); (C:\Documents and
> Settings\d and l\Application
> Data\Mozilla\Profiles\default\yxchk98c.slt\prefs.j s)
> N3 - Netscape 7: user_pref("browser.search.defaultengine",
>
"engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csea rchplugins%5CSBW
eb_01.src");
> (C:\Documents and Settings\d and l\Application
> Data\Mozilla\Profiles\default\yxchk98c.slt\prefs.j s)
> O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
> C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
> O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -
> C:\PROGRA~1\SPYBOT~2\SDHelper.dll
> O2 - BHO: Freedom BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} -
> C:\Program Files\Zero Knowledge\Freedom\freebhor.dll
> O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} -
> C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
> O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
> C:\WINDOWS\System32\msdxm.ocx
> O3 - Toolbar: Norton AntiVirus -
> {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton
> SystemWorks\Norton AntiVirus\NavShExt.dll
> O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
> O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe
> O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0
> -k
> O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH
> Jukebox\mm_tray.exe
> O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE
> C:\WINDOWS\System32\NvCpl.dll,NvStartup
> O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
> O4 - HKLM\..\Run: [POINTER]
> C:\DELL\Drivers\R34790\Mouse\SETUP\MSH\Mouse\point 32.exe
> O4 - HKLM\..\Run: [QD FastAndSafe] C:\My Shared Folder\software\Norton
> SystemWorks 2003-Retail\norton\FASTSAFE\QDCSFS.exe /startup
> O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
> Files\Real\Update_OB\realsched.exe" -osboot
> O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec
> Shared\ccApp.exe"
> O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec
> Shared\ccRegVfy.exe"
> O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
> /STARTUP
> O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
> O4 - HKLM\..\Run: [AVG7_RegCleaner]
> C:\PROGRA~1\Grisoft\AVG7\avgregcl.exe /BOOT
> O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe"
> /background
> O4 - HKCU\..\Run: [Zero Knowledge Freedom] C:\Program Files\Zero
> Knowledge\Freedom\Freedom.exe
> O4 - HKCU\..\Run: [Evidence Eliminator] C:\Program Files\Evidence
> Eliminator\ee.exe /m
> O4 - HKCU\..\Run: [Desktop Weather 3] C:\Program Files\The Weather
> Channel\The Weather Channel.exe
> O4 - Startup: DNSKong.lnk = C:\Program
> Files\Pyrenean\DNSKong\DNSKong.exe
> O4 - Startup: MemTurbo.lnk = C:\Program Files\Silicon Prairie
> Software\MemTurbo\memturbo.exe
> O4 - Startup: proxomitron.lnk = C:\Program Files\Proxomitron
> Naoko-4\Proxomitron.exe
> O4 - Global Startup: PGPtray.lnk = ?
> O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone
> Labs\ZoneAlarm\zonealarm.exe
> O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions
> present
> O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel
> present
> O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
> O9 - Extra button: Messenger (HKLM)
> O9 - Extra 'Tools' menuitem: Messenger (HKLM)
> O12 - Plugin for .spop: C:\Program Files\Internet
> Explorer\Plugins\NPDocBox.dll
> O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -
>
http://v4.windowsupdate.microsoft.co...?1059844265546
> O17 -
> HKLM\System\CCS\Services\Tcpip\..\{5F3482F9-45D5-46AB-86E7-AFA29D8F6707}:
> NameServer =
> 127.0.0.1,63.240.76.5,204.127.202.5,204.127.198.5, 216.148.227.75

[Mr. Sandman]

On Mon, 15 Sep 2003 05:38:38 GMT, "YoKenny" <YKnot@home.invalid>
wrote:

>Looks like you are running two anti virus applications and two firewalls
>plus Evidence Eliminator. (spit) Also looks like a RAM optimizer as well.
>No wonder you are having problems.
>http://badtux.org/eesucks/index.html
>
>I hear that Norton System (doesn't)Works causes more crashes than it
>prevents.
>
>Get rid of memturbo.exe. Do a Google Group search to see the problems it
>causes.
>
>Run only one firewall and one anti virus application.
>
Thanks for the help. Seems I was causing some kind of conflict with
True Vector service, which ended up being zone alarm. I have un
installed it and have had no more problems.

[Jay T. Blocksom]

On Mon, 15 Sep 2003 00:56:02 GMT, in <alt.privacy.spyware>, Mr. Sandman
<IBEW_Wireman@union.yes> wrote:
>
[snip]
>
> First of all thank you for taking the time too help me try and figure
> this out. I am pretty much a newbie but am trying too learn.
[snip]

Then start here:

<http://www.hevanet.com/peace/microsoft.htm>
or <http://www.futurepower.net/microsoft.htm>

then go here:

<http://www.litepc.com/>

Note that these sites are ONLY a start -- "the tip of the iceberg", if you
will.

> I have
> 17.7GB of hard drive space.
[snip]

That's more than plenty.

However, you *do* have some definite problems:

> Logfile of HijackThis v1.96.0
> Scan saved at 7:50:44 PM, on 9/14/2003
> Platform: Windows XP SP1 (WinNT 5.01.2600)
> MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
>
> Running processes:
[snip]

> C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
> C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
> C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
> C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
> C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
> C:\WINDOWS\System32\nvsvc32.exe
[snip]

Two different AV utilities, both of which are running constantly? Not good.

> C:\Program Files\Kerio\Personal Firewall\persfw.exe
> C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
> C:\WINDOWS\System32\svchost.exe
> C:\WINDOWS\system32\ZoneLabs\vsmon.exe
[snip]

Two different "software firewalls" (which are by definition *inherently*
near-useless anyway), both of which are running constantly? Not good.

> C:\WINDOWS\System32\PGPsdkServ.exe
[snip]

PGP Software Development Kit Service. Why?

> C:\Program Files\DU Meter\DUMeter.exe
[snip]

Not necessarily a problem in and of itself, but certainly an unnecessary
complication in any event. I *think* AdAware targets this, but ICBW.

> C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
[snip]

Known spyware.

> C:\Program Files\Common Files\Real\Update_OB\realsched.exe
[snip]

Eeeeeewwwww. *Nothing* from Real Networks should *ever* be permitted within
50 yards of your computer. Enforce this at gunpoint, if necessary.

> C:\Program Files\Common Files\Symantec Shared\ccApp.exe
[snip]

More Symantec crap.

> C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
> C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
[snip]

More AVG "stuff".

> C:\Program Files\Messenger\msmsgs.exe
[snip]

MSN Messenger Online Chat and Instant Messaging Client. YUCK!

> C:\Program Files\Zero Knowledge\Freedom\Freedom.exe
[snip]

My Ghod, man... Are there *any* snake-oil programs you haven't downloaded
and installed?

> C:\Program Files\Evidence Eliminator\ee.exe
[snip]

Oh, *W-O-W*!

This is perhaps *the* most completely evil thing on your list. WhatEVER
possessed you to install this crap? You desperately need to read this:

<http://ee-sucks.tripod.com/>
<http://evidence-eliminator-sucks.com/>
<http://www.geocities.com/evidence_eliminator_sucks/>
<http://www.wasaa.com/ee.php>
<http://www.radsoft.net/resources/software/reviews/ee/>

RIGHT NOW.

There's more -- LOTS more. But at this point, I see nothing to gain from a
further blow-by-blow. It is *painfully* obvious that your system is *SO*
completely hosed that nothing short of a complete re-format and metal-up
reinstallation of a proper OS and (*only*) whatever legitimate applications
you need can possibly be trusted to straighten things out.

But even beyond that, you need to *seriously* rethink your entire approach
to the computer.

--

Jay T. Blocksom
--------------------------------
Appropriate Technology, Inc.
usenet01[at]appropriate-tech.net


"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
-- Benjamin Franklin, Historical Review of Pennsylvania, 1759.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NOTE: E-Mail address in "From:" line is INVALID! Remove +SPAMBLOCK to mail.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Unsolicited advertising sent to this E-Mail address is expressly prohibited
under USC Title 47, Section 227. Violators are subject to charge of up to
$1,500 per incident or treble actual costs, whichever is greater.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

[Mr. Sandman]

Is there a way too check logs? Then I could find out "why " I am
crashing?