Windows Registry

[Broni]

I can't see anything.

Perform the action listed below, but leave Avast startup(s), and service(es) alone. After restart, try Avast scan again.

Go Start>Run (Start Search in Vista), type in:
msconfig
Click OK (hit Enter in Vista).

Click on Startup tab.
Click Disable all

Click Services tab.
Put checkmark in Hide all Microsoft services
Click Disable all.

Click OK.
Restart computer in Normal Mode.

NOTE. If you use different firewall, than Windows firewall, turn Windows firewall on, just for this test, since your regular firewall won't be running.
If you use Windows firewall, you're fine.

[patio]

I can't see anything either...
But my eyes are going .

[Sceptical]

O.k.
Done that and will now run the scan.
I take it you meant disable all then re check the Avast stuff?
Cheers
Did a thorough scan. Nothing found.

[Broni]

It's not about finding anything.
You said:

Nearly a month after formatting and the BSOD's are back with a vengance.
Two today within an hour of each other.
The second happened trying to do a Avast virus scan

Now, you ran the scan with most startups, and services disabled, and nothing happened.
It's gonna be up to you to perform investigation.
Go back to services, and enable one of disabled ones.
Restart computer, and use it for a while.
If nothing happens, enable another one, and so on, until you'll find the culprit.
If services check out OK, start enabling startups, one by one.

[Sceptical]

Hmmm.
I obviously did something wrong.
I have just gone to services and they are nearly all checked.

Epson V3 Service
2x Google
Windows card space
Java
Lavasoft
NBService
NMIndexing Service
NVidea Display Driver Service
Windows Media Network Sharing Service
Are all unchecked.

In Start Up only
ash Disp and ctfmon are checked.

In the general tab it is on selective sart up and Load System Services and the Start Up buttons are unchecked.
Why would the services load if the button is un checked?
Anyway, that rules out most of the services in one foul swoop.
Do I actually need any of these start up items?

[Broni]

I wanna see those startups better....

Download, and install Quick Startup: http://www.glarysoft.com/qs.html
Go File>Export, save report, and paste it into your next post.

[Sceptical]

There are onlt three running, did you want me to enable all and post that file?


    Name: avast!
    Path: C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
 Status: Enabled
------------------------------------------------------------------------------------------

    Name: CTFMON.EXE
    Path: C:\WINDOWS\System32\CTFMON.EXE
Location: HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run
 Status: Enabled
------------------------------------------------------------------------------------------

    Name: ctfmon.exe
    Path: C:\WINDOWS\system32\ctfmon.exe
Location: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
 Status: Enabled
------------------------------------------------------------------------------------------
Total 3 Items

[Broni]

Yes, please.

[Sceptical]

Startup List report created on 09/05/2009 by Startup Manager


    Name: avast!
    Path: C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
 Status: Enabled
------------------------------------------------------------------------------------------

    Name: SunJavaUpdateSched
    Path: "C:\Program Files\Java\jre6\bin\jusched.exe"
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
 Status: Enabled
------------------------------------------------------------------------------------------

    Name: Sony Ericsson PC Suite
    Path: "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
 Status: Enabled
------------------------------------------------------------------------------------------

    Name: QuickTime Task
    Path: "C:\Program Files\QuickTime\qttask.exe" -atboottime
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
 Status: Enabled
------------------------------------------------------------------------------------------

    Name: Omnipage
    Path: C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
 Status: Enabled
------------------------------------------------------------------------------------------

    Name: nwiz
    Path: nwiz.exe /install
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
 Status: Enabled
------------------------------------------------------------------------------------------

    Name: NVRaidService
    Path: C:\WINDOWS\System32\nvraidservice.exe
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
 Status: Enabled
------------------------------------------------------------------------------------------

    Name: NvMediaCenter
    Path: RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
 Status: Enabled
------------------------------------------------------------------------------------------

    Name: NvCplDaemon
    Path: RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
 Status: Enabled
------------------------------------------------------------------------------------------

    Name: NeroFilterCheck
    Path: C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
 Status: Enabled
------------------------------------------------------------------------------------------

    Name: Cmaudio
    Path: RunDll32 cmicnfg.cpl,CMICtrlWnd
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
 Status: Enabled
------------------------------------------------------------------------------------------

    Name: Adobe Reader Speed Launcher
    Path: "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
 Status: Enabled
------------------------------------------------------------------------------------------

    Name: Ad-Watch
    Path: C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
 Status: Enabled
------------------------------------------------------------------------------------------

    Name: CTFMON.EXE
    Path: C:\WINDOWS\System32\CTFMON.EXE
Location: HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run
 Status: Enabled
------------------------------------------------------------------------------------------

    Name: ctfmon.exe
    Path: C:\WINDOWS\system32\ctfmon.exe
Location: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
 Status: Enabled
------------------------------------------------------------------------------------------

    Name: swg
    Path: C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
Location: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
 Status: Enabled
------------------------------------------------------------------------------------------

    Name: EPSON Stylus Photo R265 Series
    Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBNE.EXE /FU "C:\WINDOWS\TEMP\E_S146.tmp" /EF "HKCU"
Location: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
 Status: Enabled
------------------------------------------------------------------------------------------

    Name: Microsoft Office
    Path: C:\PROGRA~1\MICROS~3\Office10\OSA.EXE -b -l
Location: C:\Documents and Settings\All Users\Start Menu\Programs\StartUp
 Status: Enabled
------------------------------------------------------------------------------------------
Total 18 Items

[Broni]

1. Download, and run  CTFMON-Remover: http://www.gerhard-schlager.at/en/projects/ctfmonremover/
The CTFMON-Remover helps you removing the annoying CTFMON.EXE from your Windows operating system. The program is easy to use and displays whether the CTFMON.EXE is installed and running or not. If it was found then you can remove it within seconds. Just in case that you need the CTFMON sometime in the future there is also an option to restore the original one.
Note:The CTFMON.EXE is among other things responsible for changing the language schema of your keyboard (e.g. for switching between the German and English keyboard layout). So in case you are using this feature you shouldn't remove or disable the CTFMON.EXE!
NOTE. CTFMON.EXE is not a threat, but unnecessary startup, which can't be disabled in any other way.

2. Download, and run QuickTime Killer: http://www.softpedia.com/get/System/Launchers-Shutdown-Tools/QuickTime-Killer.shtml
After downloading, double click on EnGraphQuickTimeKillerInstaller.msi file.
You may be asked to download, and install .NET Framework
QuickTime Killer will remove QuickTime from start up and kill any running QuickTime processes. This application runs silently at start up and closes itself as soon as it takes care of QuickTime. QuickTime itself won't be removed from your computer, and will be available whenever needed.
NOTE. QuickTime is not a threat, but unnecessary startup, which can't be disabled in any other way.

3. I recommend, you uninstall Adobe Reader, along with Adobe Reader Speed Launcher, and switch to FoxIt: http://www.filehippo.com/download_foxit/. It's much lighter, and faster, than Adobe. It does very same thing.

4. I recommend, you uninstall Ad-aware, which doesn't do much except for running an extra service on startup, even, if the program itself is not running.
Much better alternatives:
- SUPERAntiSpyware Free Edition: http://www.superantispyware.com/download.html
- Malwarebytes' Anti-Malware (trial version is fully functionable): http://www.malwarebytes.org/mbam.php

5. Using QuickStart, un-check following entries:
- SunJavaUpdateSched
- Sony Ericsson PC Suite
- Omnipage
- nwiz
- NvCplDaemon
- NeroFilterCheck
- Cmaudio
- EPSON Stylus Photo R265 Series
- Microsoft Office

[Sceptical]

Step 1. Done

Step 2. .NET Framework won't install, i have tried re booting but i just get 'Setup Error' in the top left of the .net framework 3.5 set up window?

Step 3. In add remove i have Adobe AIR, Adobe Flash Player 10 Active X and Adobe Reader 9.1. Uninstall all?

Step 4. Done

Step 5. Done

[Broni]

2. No big deal with QuickTime. Forget it.
3. Leave Adobe Flash Player 10 Active X alone. Two others can go.

[Sceptical]

O.k.
All done.
What now, wait and see??

[Broni]

Yeah, see how the computer will behave now.

[Sceptical]

O.k. Cheers for that.
One thing since doing all this, on start up, as i go from the welcome screen to my account i get a quick flash of a command prompt screen, too quick to see anything.
Is this a part of one of the progs i have installed?