Strange Behavior

[Sapphire]

I went to control panel, clicked on administrator tools, clicked on event viewer, and this is an error message for acpi, in the system error messsage.

[dl65]

AMLI: ACPI BIOS is attempting to read from an illegal IO port address (Ox71), which lies in the Ox70-Ox71 protected address range. This could lead to system instability.

I believe this error is refering to a sound card problem ....

Would that make any sense ?

dl65  

[Fed]

A quick google tells what it is but I don't think it's causing the problem.
(Advanced Configuration and Power Interface)
Who knows  

Saphire, another thing for you to try...
Re-boot your computer, open the Task Manager and stop all the running programs in the Applications tab.

Then click on the Processes tab, look for an instance of NTVDM and if it's there then stop it, clicking OK to any warnings.

Then go back to Start>Run & try to run regedit again.

[dl65]

Sapphire  ......... Were you ever able to open up hijackthis ? Because I think your PC  is still infected with trojans.....  If you have a floppy drive on your pc ......... use another pc and d/l hijackthis again and save it to a floppy .....then run it on your pc and post the log here for us to look at ...... Some trojans or viruses ....will prevent you from accessing the registry and not allow your antivirus software to run properly .......

let us know

dl65  

[Fed]

I agree DL65, or maybe it was a bug that did some damage but now it's been removed & the damage remains.  
The truth is out there....

[Sapphire]

Nope, I do not have a NTVDM process running on task manager.

I tried again, and still cannot open hijackthis.


But I do notice, whenever I reboot, I check the event viewer, and keep finding that same error message for Advanced Configuration and Power Interface.

[dl65]

Sapphire...... Could you try to D/L hijackthis from .....
http://www.majorgeeks.com/download3155.html   ....D/L V 1.99.1    and save it to a floppy disk   ( I know you have tried to open it up and cant )    It should run ok for you from the floppy ........
BTW , when you tried to open it before , did you get any error message ?  
Are you able to access anything in your control panel ?

let us know

dl65  

[Sapphire]

Why didn't someone tell me I had to extract the hijackthis.exe file from the zipped folder? Now I can open it. I'll be back with my results.

[Fed]

Sorry, I assumed you knew to execute execute files to run them.  

Anyway, read the directions and do a simple scan, after the scan save the logfile and post it up for DL65.

I seem to remember something about saving Hijackthis to it's own directory (folder) so the save scan option will work. It's been a while since I installed it.

[Sapphire]

Logfile of HijackThis v1.99.1
Scan saved at 9:32:04 PM, on 5/30/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)


Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\pavsrv51.exe
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\AVENGINE.EXE
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\PsImSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\apvxdwin.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\WebProxy.exe
C:\WINDOWS\System32\ctfmon.exe
C:\aolextras\icons\HijackThis.exe
C:\Program Files\Netscape\Netscape\Netscp.exe

[Sapphire]

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.begin2search.com/sidesearch.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://scottstapp.com/
N3 - Netscape 7: user_pref("browser.startup.homepage", "scottstapp.com"); (C:\Documents and Settings\user\Application Data\Mozilla\Profiles\default\b18nhr40.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\user\Application Data\Mozilla\Profiles\default\b18nhr40.slt\prefs.js)
O2 - BHO: (no name) - SOFTWARE - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {41601034-0A76-34BC-12E0-AD2A13FF3339} - C:\WINDOWS\Bsxuthmp.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Search - {9CD7F666-9462-3EC2-341B-C0708821D4A4} - C:\WINDOWS\Bsxuthmp.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [EPSON Stylus Photo R300 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE /P30 "EPSON Stylus Photo R300 Series" /O6 "USB001" /M "Stylus Photo R300"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [qCP8fRoqE] C:\windows\temp\qCP8fRoqE.exe
O4 - HKLM\..\Run: [AOydxuV] C:\windows\temp\AOydxuV.exe
O4 - HKLM\..\Run: [4bS] C:\Documents and Settings\user\Local Settings\Temp\4bS.exe
O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\pavsrv51.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\PsImSvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

[Fed]

Can you right click on your regedit.exe and check the file size & version against mine?
There has to be a reason why it won't open.

Mine is version 5.0.2195.6707 with Size 71.7 KB (73,488 bytes)

If yours is the same I guess it's ok but if it's different it may be because I'm on w2k so then we will compare it with an xp one.

[Sapphire]

size: 132 kb (135,168 bytes)


version: 5.1.2600.1106

[Fed]

size: 132 kb (135,168 bytes)  
version: 5.1.2600.1106

Wait for DL65, he probably has xp.

BTW, any other things of interest in your Event Viewer, if you Dclick on an event you can then scroll down each event from that new window.

EDIT...
So as not to confuse things, maybe start a new thread for

AMLI: ACPI BIOS is attempting to read from an illegal IO port address (Ox71), which lies in the Ox70-Ox71 protected address range. This could lead to system instability.

[Sapphire]

Nope, just that  one error message, if that's what you mean?