Forum Home
Press F1
 
Thread ID: 83704 2007-10-10 07:33:00 Log-on instant crash ihavenoidea (12907) Press F1
Post ID Timestamp Content User
599973 2007-10-10 09:10:00 OK. Run hijackthis again tick these entries then tick fix checked.

Close browsers (altho I dont think any are open).

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

These are safe but dont have to run on startup

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE

If you dont have a remote control for PowerDVD, tick this

O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\System32\NeroCheck.exe

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

If you dont use Nero Home, tick this

O4 - HKCU\..\Run: "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"

[B]These maybe nasty

These may belong to an adult dialler.

O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab
O16 - DPF: {33331111-1111-1111-1111-611111193458} - file://c:\ex.cab
O16 - DPF: {33331111-1111-1111-1111-622221193458} - file://c:\ex.cab
O16 - DPF: {43331111-1111-1111-1111-611111195622} - file://c:\ex.cab
O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab

I would also get trojan remover (www.simplysup.com)

Install it on this computer, then click on scan. Select all options under the utilities menu. Then open my computer, highlight c, / right mouse, and do a scan with trojan remover. Then reboot.

If it continues to crash AFTER this, boot into safe mode again go to control panel / admin tools / event viewer.

Go to the application entry on the left go thru the entries on the right. See if there are any entries with an X or error

If there is, tell us what it says, about the time it crashes.

Also look under the system entry on the left. 		Speedy Gonzales (78)
599974 2007-10-10 09:20:00 I just got this message duing the scan

This file is called by a services registry key
C:\WINDOWS\system32\drivers\InCDFs.sys

An executable file with this file name has not been found

This file is loaded by the following registry key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\InCDFs\"ImagePath"

Should I leave this in place or remove it? 		ihavenoidea (12907)
599975 2007-10-10 09:28:00 Select remove reference from registry.

Then it'll tell you to reboot. Reboot. 		Speedy Gonzales (78)
599976 2007-10-10 10:41:00 Hi,

I did both the HIjack This fix check and the Trojan Removal and tried to reboot in normal mode and while it got a lot further than normal it still crashed again.

Any ideas on next steps? 		ihavenoidea (12907)
599977 2007-10-10 18:57:00 From my previous post

If it continues to crash AFTER this, boot into safe mode again go to control panel / admin tools / event viewer.

Go to the application entry on the left go thru the entries on the right. See if there are any entries with an X or error

If there is, tell us what it says, about the time it crashes.

Also look under the system entry on the left.

Also boot into safe mode, right mouse on my computer on the desktop.

Advanced tab / settings (under startup and recovery). Untick automatically restart then click on OK twice.

Then reboot. When it crashes again it may bring up a blue screen, with the name of a file, or a stop error.

Tell us, what it says. 		Speedy Gonzales (78)
599978 2007-10-11 07:43:00 Thanks for your patience, read your post again.

This is what event viewer is telling me:

Application has two errors:
VSS, None, 8193, N/A
Event System, (50), 4609, N/A

System has four errors:
Service control manager, none, 7026, N/A
DCOM, None, 10005, SYSTEM
DCOM, None, 10005, SYSTEM
DCOM, None, 10005, SYSTEM (appears three times)

Have just changed the reboot settings and while reboot now to see if I get blue screen 		ihavenoidea (12907)
599979 2007-10-11 07:55:00 Got a blue screen with this message

STOP: 0x0000008E (0xC0000005, 0x80612C2D, 0xF6B12BB4, 0x00000000) 		ihavenoidea (12907)
599980 2007-10-11 07:58:00 It could be because you havent got SP2.

This computer hasnt been updated recently has it??

Since its not on the net, or on a network.

When was this computer last updated / patched?

Are the video drivers on this computer Nvidia drivers? 		Speedy Gonzales (78)
599981 2007-10-11 08:03:00 Got a blue screen with this message

STOP: 0x0000008E (0xC0000005, 0x80612C2D, 0xF6B12BB4, 0x00000000)

OK.

That 0x0000008E could mean this (support.microsoft.com)

this (support.microsoft.com)

Try killing the password in safe mode, remove it. Then boot normally.

See what happens. 		Speedy Gonzales (78)
599982 2007-10-11 08:07:00 How do I "Try killing the password in safe mode, remove it"?

I tried to update recently and my PC crashed halfway through the update. I am connected to the net but not a network.

How do I tell if the video drivers are Nvidia drivers? 		ihavenoidea (12907)
1 2 3 4