Forum Home
Press F1
Thread ID: 88460	2008-03-28 03:21:00	Registry crashes - Dazed and confuse despite Press F1	SanchoPanza (8775)	Press F1

Post ID	Timestamp	Content	User
653480	2008-03-28 03:21:00	Greetings, I have been reading Press F1 most of the day trying to figure out what may be causing my system to crash (BSOD - non-paged fault blah blah blah), generate error reports on log-in, and freeze or BSOD the system anytime I run a spyware remover tool. System: AMD 2800+ Athlon, 512MB RAM (memtest86 tested this week - no errors), Asus 7300GT 256MB, 2 HDD, no RAID, Asus A7V600-X Mobo OS: XP SP2 plus every update ever released Other stuff: Comodo Firewall, AVG antivirus, AVG antispyware, AdAware, CCleaner To date I have scanned the system with each of the aformentioned security products. AVG anti-spy and AdAware both crash / lock-up during scanning of the registry. After reading the numerous posts on similar issues I have run HiJackThis, see below. Under Event Viewer - Applications, the only issues are the kids games crashing. Under Event Viewer - System, W32time shows up consistently, the most recent log-in error report (details below), kl1 (Kapersky Labs), ASInsHelp, and the odd DHCP error because the cat de-powered the router. Any help would be very much appreciated, ta. Latest error report data: Error code 00000050, parameter1 fffefff8, parameter2 00000000, parameter3 8054aa32, parameter4 00000000. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:51:48 p.m., on 28/03/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7_5\guard.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\Program Files\COMODO\Firewall\cmdagent.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\COMODO\Firewall\cfp.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Downloads\HiJackThis.exe C:\WINDOWS\system32\svchost.exe O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Startup: PowerReg Scheduler.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7_5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\Firewall\cmdagent.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 4034 bytes	SanchoPanza (8775)
653481	2008-03-28 03:28:00	This could be the culprit - Run HJT again, and remove O4 - Startup: PowerReg Scheduler.exe Also open Ccleaner - run the Reg on the left hand side, tell it to scan for issues. While at it downloadThis Antimalware program (www.malwarebytes.org) ( Free Version) & run it - The powerReg is part of malware/spyware. If it still crashes, right click My Computer/Properties/Advanced Tab /Startup and recovery /Settings - Untick Automatically restart, and write down the complete BSOD and post back here what it says.	wainuitech (129)
653482	2008-03-28 03:48:00	And tick these entries as well O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k And uninstall all versions of Java, latest version is in my sig And install the latest version Of Comodo, its now up to 3.0.21.329	Speedy Gonzales (78)
653483	2008-03-28 04:35:00	Thanks to both of you for your responses. After ticking just powerreg everything behaved alright from that point forward. A bit more history, automatic updating for both Comodo and Java had failed on Wednesday which had prompted me to run all the anti-spyware programs in the first place. After removing things my system is now fine and dandy. Many thanks, problem solved. You guys (gals?) do good things here, keep it up.	SanchoPanza (8775)
653484	2008-03-28 06:50:00	Glad it sorted it so quick :thumbs: Just for reference - Speedy & Wainuitech both guys. Just a bit of advice, pays to run programs like Ccleaner regularly as well as antispyware if it doesn't have a scheduler available.	wainuitech (129)
1