Posts by DMR

There's nothing conclusive that I can draw from that batch of errors, although a couple of them are usually indicative of fairly low-level problems.

* Have you changed any hardware or updated any driver software lately?

* Does the " Hanging application mghtml.exe" error occur frequently? mghtml.exe is a component of McAfee's antivirus/Internet security software packages; uninstalling and reinstalling that software might help.

* The "{0002DF01-0000-0000-C000-000000000046}" error is related to a problem with some component of Internet Explorer. You can try re-registering IE's components (specifically, its core .dll files) by running the free IEFix utility.

* In terms of the "Device\Ide\IdePort2" error: I've seen reference to that being a bug in certain versions of Windows' atapi.sys driver, including the version installed with XP SP2, although I haven't confirmed the bug myself. Other reasons for that range from simply not having a disc (or having a bad or blank disc) in your CD/DVD drive to a bad IDE cable or failing IDE port on the motherboard. Let's leave that error alone for now, as we have nothing to indicate that the error is critical.

* "Error code 00000044". That error is most commonly indicative of a problem with a device driver, or with your RAM. If you've recently updated/changes any drivers, revert to the prior driver version(s) and see if doing so has any effect. If you haven't made any such changes, I'd do an extended/thorough test your RAM with one of the following …

Thanks for the model #; Samsung does have a downloadable diagnostic and low-level formatting tool for that drive. A download link for the utility, as well as a graphical description/tutorial, can be found here.

The instructions are a bit sketchy grammatically-speaking, but the basic upshot is this:
* The utility runs from a bootable floppy disk, so you'll need to prepare one of those ahead of time.
* Download the utility program's installer (Hutil_creator.exe) and copy it to the floppy.
* Run Hutil_creator.exe to extract the actual program files to the floppy.
* Boot the system from the floppy, and when presented with the DOS "A:\" prompt, type the following command and then hit Enter:
Hutil.exe

The utility can perform a low-level format, which resets the Master Boot Record and Partition Table, but I'd try the Recover Native Size option first; it looks like just the thing you need:
"If you want to recover to the original size of drive, perform RECOVER NATIVE SIZE by pressing Enter Key. DISPLAY CURRENT STATUS represents the current size of drive."

Try the utility, and be sure to post any questions you might have before proceeding with any steps that you are unsure of.

I don't understand it either, but I'm glad you got it working. :)

OK- repost when you can; we'll be here...

NoAdware was actually delisted from the category of Rogue/Suspect antispyware programs because they have supposedly cleaned up their act regarding false positives and other "questionable" behaviour. However, I personally refuse to recommend "antispyware" programs which have histories of such blatant deception; there are plenty of other reputable (and free) utilities available.
Since you say that you are experiencing homepage hijacks, you may very well have "unwanted guests" which need to be removed. Let's check out that possibility.

Download the free HijackThis utility. Once downloaded, follow these instructions to install and run the program:

Create a new folder for HJT outside of any Temp/Temporary folders and move the downloaded HijackThis.exe file to that folder now. A folder such such as C:\HijackThis or C:\Spyware Tools\HijackThis will do.

Run HijackThis, but do not have HJT fix anything yet; only have it scan your system! Once the scan is complete, the "Scan" button will turn into an option to "Save log...".
Save the log in the folder you created for HijackThis; the saved file will be named "hijackthis.log". Open the log file with Windows Notepad, and cut-n-paste the entire contents of the Notepad file here.

The log contents will tell us a lot about what "nasties" have crept into your system, and once we analyse the log we can tell you what to do from there.

I'd let chkdsk run its course. If that doesn't clear things up:

* Does the computer boot into Safe Mode (Command prompt only) or Last Known Good Configuration?

* You can try a "Repair" installation of XP. Instructions are here:
http://www.pcbuyerbeware.co.uk/RecoveringXP.htm#repair

I tried going to start, run, control.exe

Try Start, Run, eventvwr.msc instead.

What is the exact make/model of the drive? You may need to attack it with a low-level diagnostic/formatting utility from the manufacturer (if you haven't tried that already).

That error is indicative of a hardware problem, but you'll have to do some troubleshooting to determine the exact culprit. The links on the first page of this Google search will give you several suggestions; try them and let us know the results.

But now my frieds 80gb hhd reads as a 20gb.

It does this even when properly reinstalled in the computer it originally came out of?

Give us specific details:

- What are the exact names/versions of the drivers?
- What is the exact make/model of the DVD drive?

Even though it seems like you're doing everything correctly, this still sounds like the classic problem of burning the CDs in the wrong format.

Let's verify a couple of things:

1. When you reinsert one of your burned "audio" cds into your computer's CD drive, how does Windows Explorer identify the drive/disk? Does the drive have the icon of a disc with a musical note on it? Is the disc identified as "Audio CD"?

2. When you view the contents of the disc in Windows Explorer, how are the tracks named and what does Explorer list in their "type" column?

Open the Event Viewer utility in your Administrative Tools control panel and look through your System and Application logs for entries flagged with "Error" or "Warning". Double-clicking on such an entry will open a properties window with more detailed information on the error; post the details from a representative sample of some of the different error messages (please don't post duplicates or flood us with the entire logs). To do so:

In the Properties window of a given entry, click on the button with the graphic of two pieces of paper on it; the button is at the right of the window just below the up arrow/down arrow buttons. You won't see anything happen when you click the button, but it will copy all of the details to the Windows clipboard. You can then paste the details into your next post here.

Ok- I think we have a suspect.

Run HijackThis again, put a check in the box to the left of the following entry, and then click the "Fixed Checked" button:

O4 - HKLM\..\Run: [RecoverFromReboot] C:\WINDOWS\Temp\RecoverFromReboot.exe

Once HJT finishes the fix, close the program and then reboot the computer. Let us know if that fixes the startup problem with the installation program.

Regedit.com is not a valid Win XP executable, and is usually the component of an infection; the legit filename is regedit.exe.
Although I see no signs of infections in your HJT log, please read the information in these two links for more information on one infection known to create a "regedit.com" file in the C:\Windows\System32 folder:

http://www3.ca.com/securityadvisor/virusinfo/virus.aspx?id=43234
http://securityresponse.symantec.com/avcenter/venc/data/w32.alcra.a.html

Look for the telltale signs described in the links and let us know what you find.

Thanks for the follow-up info pulsewidth16 :)

I've marked this thread as solved, but please repost if that turns out not to be the case.

By the way- why have you posted this in the Network Security forum? The question sounds better suited to one of other forums...

You've given us very little information to go on; please be more specific. Details such as what exactly you are trying to accomplish, what hardware/software is involved, etc. would be quite helpful.

For the scenario you describe, you will need to configure Internet Connection Sharing (as mentioned in the link chrisbliss18 provided). Step-by-step instuctions for setting up ICS on Windows XP machines can be found here.

Thanks for the info; I was asking primarilly because the "command service" infection normally has an associated 023 entry, which isn't present in your logs. Perhaps it was removed by disinfection proceedures you've already performed.
Also: Your HJT log shows no indication of an antivirus program running on your system- this is definitely a Bad Thing!

Please do the following:

You will need to close/quit all web browser programs and disconnect from the Internet for much of the following, so you should print out these instructions or save them into a text file with Notepad.

1. Download and install the following utilities:

CCleaner - www.ccleaner.com
Webroot Spy Sweeper (14 day free trial) - http://www.webroot.com/shoppingcart...4011&vcode=DT02
AVG Antivirus (free edition) - http://free.grisoft.com/doc/Get+AVG+FREE/lng/us/tpl/v5

- Open Spy Sweeper, click on "Options", and then click on "Update Definitions" under the Program Options tab. Do not run a scan yet; just close the program once the update completes.

- You already seem to have ewido installed. Open ewido and, in the main screen, click "Update" and click "Start Update". After the update process completes, exit from Ewido.

- Open AVG and make sure that it has the most current virus definitions installed. Again- don't scan yet, just close the program once it's updated.

2. Run HijackThis again, put a check in the boxes to the left of the following entries, and then click the Fix Checked button. Close HJT …

A couple of additional suggestions:

* Boot the computer into Safe Mode (you get to the safe mode boot option by hitting the F8 key as your computer is starting up) and see whether or not the freezing behaviour is the same as when booted normally.

* Open the Event Viewer utility in your Administrative Tools control panel and look through your System and Application logs for entries flagged with "Error" or "Warning" which might seem to be related to the freezes. Double-clicking on such an entry will open a properties window with more detailed information on the error; post that info here. To do so:

In the Properties window of a given entry, click on the button with the graphic of two pieces of paper on it; the button is at the right of the window just below the up arrow/down arrow buttons. You won't see anything happen when you click the button, but it will copy all of the details to the Windows clipboard. You can then paste the details into your next post here.

Just one question before we begin cleaning your system: Can you please double-check to make sure that you posted the complete contents of your HJT log? There are usually more services (the "023" entries) listed in a HJT log from an XP machine.

That's odd. I read posts there all the time and have yet to be denied access to any of them. Maybe I'm just lucky.

It isn't a repeatable or predicatable experience for me, and it didn't happen to me for the longest time. One day though, I read a thread there, went to a few other sites after that, and then returned to EE to read another thread. When I tried to view the thread, no replies/answers for me; just the "give us your $$ to view the solution" message. After that happened a few times I experimented with the cookie aspect a bit, but not enough to determine much more than the fact that cookies from EE played a part in the behaviour. [img]http://www.stevewolfonline.com/Downloads/DMR/Visuals/dunno.gif[/img]

You're welcome. Let us know the results of trying the RAM,BIOS, etc. possibilities.

What is Windows FD?

FD? If I recall correctly, it stands for Flawed Design. :mrgreen:

WinFS was backported to run on XP, and is/has been available in beta (Beta 1) to developers for some time. From what I've read, Beta 2 is due to be released to developers at the beginning of May, but the final shipping version isn't due for release until at least Q3 2007.

That time frame doesn't sound like it will coincide with Vista's initial release (unless MS delays Vista further), but it also doesn't sound like it will coincide with any other MS OS release either. As it currently stands, WinFS installs on top of NTFS, so I guess it could/will just be released as a stand-alone "Plop-On".

Which audio apps are you currently using and/or thinking of using on a PC? If you're doing Pro or near-Pro quality multitrack work, I'd honestly stick with the Mac.

Hi Moron,

Let's do this without the profanity from here on, OK? We are a family-oriented site, after all. :mrgreen:
Please read our posting rules if you are unclear on this or any other aspect of forum usage here.

Thanks.

Thread closed.

You don't have to pay to access the answers, just scroll past all the ads.

Actually, they do a weird (and IMHO, rather lame) thing over at EE: when you first starting browsing around their forums, you'll be able view the answers as well as the questions. However, somewhere in there they lay a cookie on you which identifies you as a previous visitor, and after that- bummage: you can't view the answers anymore. I've verified the behaviour myself by visiting/browsing the site long enough to be denied access to the answers, and then going in to my cookie manager and deleting the EE cookies. Sure enough, the next time I visit the site, I can again view answers.

The Dr. Watson problem for the poster (and others) over at EE was a corrupted or conflicting startup program. Here are a couple of quotes from the accepted answers in the EE thread:

have seen it, and apparently there are no suspisious things in the LOG file,,, but one thing i have noticed, u have SO MANY things in the startup section, some are good, but rest are just unnecessary,,,,, did u tried to disable all the startup sentries in msconfig and then checked for the problem ??
How to use msconfig >> http://www.netsquirrel.com/msconfig/

Follow the instructions above, and turn off all of your startup apps. If the problem goes away, add them back in groups (or one at a time), until it comes back. It's a …

Thanks; we're glad we could help you get it sorted out. :)

A) Instead of typing the URL of the problematic sites into your browser address bar, let us know if you can reach the sites by doing the following instead:

For the jobcentreplus site, type:
http://66.54.44.230

For the cwjobs site, type:
http://194/203/155/87

B) Are you running any firewall software or other programs which monitor/restrict Net activity?

I have also looked to see if there is a reference to it in the Start Up files but I am not sure as some of the entries there could be anything !!!!!

Very good- you're thinking along the right track :mrgreen:

Please download the free HijackThis utility and follow the instructions below to run the program. While normally used to find viruses and spyware, HJT can also be used to list and remove non-malicious startup commands and Registry entries. Hopefully it will be able to tell us what command keeps running the NTL installer.

Create a folder for HJT outside of any Temp/Temporary folders and move/extract HijackThis to that folder now. A folder such such as C:\HijackThis or C:\Spyware Tools\HijackThis will do.
Run HijackThis, but do not have HJT fix anything yet; only have it scan your system! Once the scan is complete, the "Scan" button will turn into an option to "Save log...".
Save the log in the folder you created for HijackThis; the saved file will be named "hijackthis.log". Open the log file with Windows Notepad, and cut-n-paste the entire contents of the Notepad file in your next post.

Funny this- here's a post (which was solved) from Experts Exchange dated 05/27/2004:

I'm on Windows XP Pro

Whenever I shutdown the system, I get what appears to be a Dr Watson type error (I'm guessing). The message says that dwwin.exe failed because the system is shutting down. I don't have to do anything though, the error goes away without having to be closed manually, and the the system shuts down normally.

I'd like to get rid of this error even though it doesn't seem to be hurting anything. Does anyone know what could cause it or how to fix the problem.

Look familiar?
Care to elaborate?

The aborted install has most likely left pending installation instructions/commands in the Registry.

* Does the behaviour occur when you boot the computer into Safe Mode (you get to the safe mode boot option by hitting the F8 key as your computer is starting up)?

* Can you run other programs once the problem occurs, or does it pretty much lock you out of doing anything else?

What you need to do is log in as Administrator and take ownership of the
C:\Documents and Settings\Kyle.KYLE-445F7AKRPP folder and all subcontainers and objects within that folder. An explanation of the process, with screenshots of the Properties settings involved, can be found here:

http://www.le.ac.uk/cc/dsss/docs/acls2.shtml

Welcome to DaniWeb :)
I'm sure we can help, but you'll need to give us specific details on the problems/questions you're having in order for us to know where to begin. The more information you can give us up front, the faster we'll be able to get you up and running.

...it now refuses to even start up (it refers to a dump line x)

Please give us the full and exact specifics of the error message, as well as telling us exactly where in the boot process the error appears. Also, give us some details on the history of the problem if possible.

and just install another XP based drive as master, but my PC cannot figure it out.

Not unusual- unless the computer from which you obtained the second XP drive was identical (hardware-wise) to the problematic computer, there's a very good chance that trying to use the new XP drive will just cause more headaches.

This is actually a hardware-related problem, so I'll move it to the correct forum now. Buckle up.....

I have disabled the LAN boot...

Not entirely, it appears- the PXE spewage definitely means that the system is at least trying to do a LAN boot.

...and the HDD is first boot priority and I still get nothing.

Double-check that the HDD has the highest boot priority in the BIOS. If it does, but you still get the PXE errors, that most likely means that the HDD is toast. What's happening is that, failing to boot from the harddrive, the BIOS is "falling through" the other available boot options (hence the PXE messages).

If possible, I'd pull the drive and install/test it in another computer. Obviously, you'll need a 2.5"->3.5" IDE adapter to do that.

A few thoughts:

A) You may have a corrupted Outlook folder or file; try one or both of the following:

* Run the Inbox Repair Tool. A short tutorial can be found here:
http://www.emailaddressmanager.com/outlook/repair.html

* Use the MS Office "Detect and Repair" tool: http://support.microsoft.com/?scid=kb;en-us;822238&spid=2522&sid=24

B) Scan for viruses. Before doing so, make sure that your anti-virus program has the absolutely most current updates/virus definition files installed.

C) If your anti-virus program has an email-scanning feature (most do), turn off that feature and see if doing so has any effect on the problem.

* Did you have XP Pro installed before, or was it XP Home?
* Is the new version of XP Service Pack 2, but the old version was SP1?
* Can you give us any details about the problem(s) the computer was having to begin with that caused you to reinstall?

* Here's the official article from Micorsoft concerning the RAM possibility:
http://support.microsoft.com/?kbid=315335
If you want to stress-test your RAM, you can do that by making a bootable disk with the free memtest386 utility on it.

* Given the age of the BIOS, I'd definitely update it if possible.

Installing XP from a network share is certainly possible, but you'll at least need to build a bootable floppy disk with network support.

A basic overview of one method can be found here:
http://www.networkcert.net/xp/install.htm#bootdisk

The links in this Google search have details and descriptions of the different possible methods of installing XP over a network.

... it will solve most of the booting and configuration or settings problem..

Unfortunately, that doesn't usually work for the problem indicated by the posted error message; the error (as chrisbliss18 has assessed) indicates a corrupt Registry hive. Because the Registry is processed so early on in the boot process, Windows is unable to give you much of anything to work with, including Safe Mode.

Having just done this fix two weeks ago, my hunch is that woodsf will probably have to use Microsoft's procedure outlined in the link chrisbliss18 posted.

Due to the fact that the member who originally started this thread has not responded in quite a long time, this thread is considered abandoned and has been closed.

In accordance with our posting rules, other members having similar problems should start their own threads and post their questions there. In order to help us help you most quickly, please include as much information about your problem as possible in your posts.

If the member who originally started this thread wishes to have the thread reopened, please send your request, including a link to this thread, to one of our moderators via email or Private Message.

Thank you.

When it occurs during the XP installation process, the error you are receiving usually points to a problem with your physical RAM (either a defective module or an incompatible module configuration).
Please post the full and exact contents of the error message, as the 0x0000008E code in the Stop error you're getting only indicates the general category of the error.

Hi poppaman2,

As stated in our forum rules, we ask that members not cross-post/double-post in the forums. Given that, we'll stick with your original thread, which you posted in the correct (Networking) forum.

Your latest log is clean. :)

If you're still experiencing connection problems, the first thing to do is to entirely disable the Trend Micro firewall and see if the problems disappear. If so, try uninstalling and reinstalling the product, as firewall programs do sometimes get corrupted or "confused", causing issues such as you have described.

If the problems persist even with the firewall deactivated:

* Click on the "Run..." option under your Start menu, type "CMD" (omit the quotes) in the resulting "Open:" window, and hit OK. This will open a DOS window.
* At the DOS prompt, type the following command and then hit enter:
ipconfig /flushdns
* When the command completes, you will get a message to that effect; you can then close the DOS window.

You're welcome. :)

Yep, 1 more and ya look clean to me.

There are two other entries that need fixing as well:

F2 - REG:system.ini: UserInit=userinit.exe,rgsyxwm.exe
O20 - Winlogon Notify: Shell Extensions - C:\WINDOWS\

Once you've fixed the above HJT log entries:

* Open Windows Explorer, and in the Folder Options->View settings under the Tools menu, select "show hidden files and folders", and uncheck "Hide protected operating system files" and "Hide extentions for known file types".
* Search for the "rgsyxwm.exe" file and delete it if found.
* Empty your Recycle Bin and reboot.
* Run HJT again after the computer has rebooted and post the new log.