Computer Hope
Microsoft => Microsoft Windows => Windows Vista and 7 => Topic started by: O2xDees510 on November 27, 2008, 03:16:03 PM
-
Information:
- Dell Dimension 8400
- Windows XP Home Edition; Service Pack 3
- Intel Pentium 4 Processor
- [Do not have RAM or Hard Drive Info on hand]
- Security Software: AVG, SpyBot S&D, CCleaner
I'm typing this from my laptop since I can no longer properly use my PC until resolve. I cannot describe my problem in one or several sentences but here are the major events to happen on my computer in the past 2 days:
1. Ran a windows sysinternals SID generator and changed to a custom SID for windowblinds software.
2. Computer rebooted and proceeded to administrator's desktop, but no taskbar or icons appeared nor could I right click with the mouse to bring up options. I could however use the task manager to open programs, browse the internet, etc.
3. Used system restore to 'reroll' to the day before.
4. Taskbar and icons are back, but now denied access to 'My Documents' folder on the hard drive due to permission settings somehow being relocated on an NTFS volume.
5. Rebooted in safe mode, and gained administrative ownership of 'My Documents' folder---followed these instructions (http://support.microsoft.com/kb/810881)
6. Rebooted in normal mode and still denied access and at some point ran PC in 'Last good configuration.'
7. Received this message when attempt to log-on on what is now factory default log-on screen: "Windows cannot load the user's profile but has logged you on with the default profile for the system."
8. Reboot in normal mode, but access still denied, and cannot click 'all programs' on start bar, access still denied to 'My Documents, but can use task manager to open what few programs that aren't located in 'My Documents,' and browse the internet.
9. Reboot in safe mode but mouse and keyboard become inactive at factory default log-on screen---every time.
10. Continue to do 8 and 9 in hopes of something changing but same results.
If more system information or any other recollection of events are needed, I will try my best to provide.
Cheers!
x
-
You are running two anti-virus programs. Two are as bad, if not worse, than none at all. I would remove mcaffe. I've heard a lot of bad things about it.
-
Thanks for your comment, but that's not the problem seeing that I have been running both software for months without problems.
-
You can lead a horse to water but you cant make him drink
-
that's not the problem seeing that I have been running both software for months
As JJ 3000 said, two AVs running at the same time is a problem waiting to happen. You don't have to see problem next day.
-
Well, what if I said I made a mistake and was only running AVG, how would I go about fixing my problem?
-
What if I said, I was Bill Gates?
Look, we have no time here to play games.
Two AV programs is NO-GO. Period.
If you know better, keep them.
If you want to remove one, we'll go from there.
-
If you want to remove one, we'll go from there.
I simply made a mistake and am only running AVG on the faulty computer.
-
Download HijackThis:
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download (http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download)
Click on Download HijackThis Installer
Post HijackTHis log.
-
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:47:04 PM, on 11/27/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgfws8.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - (no file)
O2 - BHO: (no name) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - (no file)
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [P2kAutostart] V330
O4 - HKCU\..\Run: [ViStart] C:\Program Files\ViStart\ViStart.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ViOrb] C:\Program Files\ViOrb\ViOrb.exe
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Post-itŪ Digital Notes.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{85CF1E87-644C-49D6-8006-9EFCA7B969A1}: NameServer = 24.25.5.150,24.25.5.149
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgfws8.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
--
End of file - 6480 bytes
By the way: as I am logged in on windows default profile a message saying something along the lines of 'Cannot find desktop'... user profile is located in 'my documents' which I am denied access to.
-
I don't see one click solution here, since we may have several issues here, or at least we have to eliminate some possibilities.
I can't be sure, how operable your computer is, so let me know, if you have any problems with performing tasks listed below.
1. The log looks clean malware-wise, but I can see some McAfee leftovers (O2 entries). Run McAfee Consumer Product Removal Tool: http://majorgeeks.com/McAfee_Consumer_Product_Removal_Tool_d5420.html
2. Not critical now, but...
You need to update Java:
http://java.sun.com/javase/downloads/index.jsp
Java Runtime Environment (JRE) 6 Update 10
Uninstall all previous versions of Java through Add\Remove.
Do it only, if you can.
3. Go Start>Run (Start Search in Vista), type in:
msconfig
Click OK (hit Enter in Vista).
Click on Startup tab.
Click Disable all
Click Services tab.
Put checkmark in Hide all Microsoft services
Click Disable all.
Click OK.
Restart computer in Normal Mode.
See, if it changes anything.
-
The faulty user profile will not let me download anything from the internet so I created another account and downloaded both software and moved startup files to shared folder. Logged back onto the faulty user profile and could not run either startup files. I also followed the rest of your instructions, but just as expected, nothing happened.
I believe this is what we must first focus on in order to fix the underlying problems.
1. Gain access and ownership to main user profile---'David'---which is located in 'documents and settings' on harddrive which was modified as NTFS volume.
2. Run safemode without it failing.
-
Yeah, your old profile may be corrupt.
Operate from new profile, and try to move your data from old profile to new one: http://support.microsoft.com/kb/811151
-
I've already tried that. When I tried to paste old profile into new one, I was still denied access. Also, I can't select files excluding Old_profile extensions .dat, .dat.log, and .ini because I can't get into it in the first place----access denied.
-
What about trying same thing from Safe Mode?
I'm aware of:
Reboot in safe mode but mouse and keyboard become inactive
Are they USB devices?
If so, can you try PS/2 stuff?
-
Not USB.. they are PS/2.
I'm going to try running saf emode using different logon settings, so I''ll be idle for 5-10 minutes.
-
OK... by some god-granted miracle, I was able to run safe mode successfully. I am now taking ownership of the corrupted user profile under Administrators (DAVID\Administrators)...
I have access to it in safe mode. I remember previously i gained access to it in safemode after gaining ownership but after restarting in normal mode, i no longer had access... Now, we must somehow alter desktop settings in safe mode??? What direction now?
-
Sounds promising.
-
I have access to it in safe mode. I remember previously when i attempted to gain ownership in safe mode, i was in the same situation as the previous post but after i ran windows in normal startup, access was still denied. I think that was due to desktop profile being corrupted somehow... where should I go from here?
-
Can you move all stuff from old profile to a new profile in Safe Mode, and then start Normal Mode under new profile?
-
Rebooted back into Normal mode, and I have access to everything. Could I prevent this problem by somehow changing my hard drive into something other than a NTFS volume?
Thanks for your help. I think I could have eventually fixed this myself, but I just needed someone who knows computers more than I do in order to hold my hand and keep my nerves calm and collected. No idea why you aren't a part of the Computer Hope staff whether it's due to your choice not to be or just have not been recognized.
Knowing my luck, I may be back here in the next several minutes, hours, or days with the same problem but at least I definitely know what to do now.
Cheers
x
-
I'm very glad, it worked out for you.
I just needed someone who knows computers more than I do in order to hold my hand and keep my nerves calm and collected
I understand it very well. That's why we're here :)
As for your other inquire, I have no comment :)
Good luck, and we'll be here, when you need us again (hopefully, not :))
-
Could I prevent this problem by somehow changing my hard drive into something other than a NTFS volume?
I don't think, you have much of a choice.
-
What if I said, I was Bill Gates?
I knew it!!
Hey Broni, can you give me a small loan? Just a couple million to get me through the holidays.
-
Hey, no problem. Anything for CH members :)