Posts by gerbil

Yep, each core has 1 or 2 MB on chip for speed buffering, but not much will happen without some RAM.

mm, not sure Adobe works like that.. [uninstall via All programs entry].. at least it does not for Photoshop
Go into Pgm Files\Adobe, look for uninstall.exe; if it exists dclick it [has to be an exe, not a dll].
No luck? Reinstall over the top of the old copy and see if the entry appears in Add/rmv pgms. Reinstalling will prob give you the option of uninstalling the old, anyway.

PSU? Voltages ok?

Ok, try just one 512MB stick... if it works just keep adding sticks and restarting, if it does not work try another....
I'm not going to try to second guess your mobo type... it's not one that has RAM dedicated to each processor is it?

You might check this key to see if there is an entry Disable Taskmgr or similar...:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
if there is you have two choices: either delete the entry name Disable Taskmgr, or change its data value to 0 [zero].
If you are running XP Pro you could just tackle it via gpedit.msc.

It's a complicated world out there....
Cheers, glad you're sorted.

That error code is indicates a kernel-mode application generated a memory access violation. I see that you have two RAM sticks so try pulling one, then swapping with the other [put the single stick in the first RAM slot..].
On the other hand it could be the actual application at fault - drivers. Can you try starting in Safe Mode.... note the last driver listed.

Happy to defer to the bloke who does this stuff every day! You are correct, caper, re SATA driver and recovery console.... I did just now check though, and when it is loading from a cd [eg, XP installation cd] it does ask for the driver but then moves happily on. Annoying, cos when I used Recovery Console from cd to play once, I believed it, hit F6 and so on... sigh. I have it now [RC] on a hd so no quibble there.

Ryun, those logs look good to me. [the Panda virus detection is okay, it has just picked up a normal file in combofix].
You may delete combofix, its extracted files, C:\qoobox and combofix.txt.
So everything is fine now?

Cool, glad you found it. Try updating/reinstalling it.

Those pgms I suggested are safe to run [normally... this is software, and to compound that it is on a computer..:)]. That is my caveat.
CCleaner should have started whizzing thru immediately, it takes up to half a minute to check all locations. Try removing it and reinstalling it. If it won't work [???] skip to Combofix.
Combofix - yes, it will delete bad files, you should let it do that. McAfee should know better - dl a fresh copyof Combofix, disconnect from the net, stop McAfee and rerun Combofix.
Then try the Panda scan again [IE only...]

Hi, John. When you start the pc, during BIOS POST do you see your hd listed? Is it SATA? If it is listed then BIOS has detected its controller hardware\software and that is working fine. IF it is listed and SATA... then XP needs a driver for that type of hd, and during Setup with your cd you will be requested to press F6 and load that driver via floppy.

Bobby, you can make some partition on disk 0 the active one, and then put the OS on another drive... it is found by the boot.ini entry on Disk 0 active partition.... handy sometimes.

Desktop\My Documents has no My... folders under it? Oh. I'm not sure how you can have that.... well, it is something I have never explored, deleting those links. I don't see why you could not, though; they are considered a bit "special" by Windows...
In C:\ Local Drive under D&S\Admin, or Dad, or Me you will see a lot of folders repeated... the items in those folders pertain to each user and yes, some are duplicated because each user is meant to have access to some same stuff - it is how some things are shared, or not. eg, if you click Me\Desktop you will see a list of the icons which appear on your desktop such as Age of Empires or Chicken Shoot, if you click Dad\Desktop you will see some diffrent icons listed, like Lawn Bowls or Things to do with Wood...
Under Application Data for each user you would have program folders - these contain files and settings for each user. And so it goes. Don't play too blindly with these.. or a lot of the others, llike Local Settings...

"which file should all files be stored under?
Directly in the c drive or in the my documents in c drive? or... in the users file?"
Personal choice rules here. I know some people who have EVERYTHING stored in My Documents. I know one person who has EVERYTHING stored in Outlook Express... I prefer to have a more extensive directory structure where related files are stored, using My Docs for temporary stuff only.

My Documents in Explorer is a list of shortcuts which give quick access to files actually held in [eg] C:\Documents and Settings\User [or Admin, or...]\My Documents\My.....
So there is no actual duplication of files. As an example and to illustrate what I mean by that, rclick on My Documents\My Pictures in Explorer, > Properties and read Location. See where the file actually is?
When you go on the web it is safer to go on as a User - that way access to registry is limited. Really the only time you need to be logged on as an admin is when you wish to alter your setup... to install some pgms, fiddle with the OS, or run some certain pgms which involve checking/changing registry settings or reading\modifying system stuff.

If you remove User accounts you won't destroy the files belonging to them; if you are just going to run as an administrator you will have access to everything.
If in the future you decide to create a new user account [even with the original name] for yourself you will not have access from that new user account to the My Documents files that were under that orig user name [or any other] -you will have to take ownership of them.
If you run as an administrator stuff you download from the web [unintentionally] will have access to everything.
Clear?

Copy these downloads into the pc. They fit on a floppy.

==Download SDFix from here: http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
and save it to your desktop. Dclick SDFix.exe and choose Run to extract it to %systemdrive%, which commonly will be C:\

==Download this temp file cleaner from http://www.atribune.org/ccount/click.php?id=1 --click in the download window to run it, and when ATF Cleaner opens go Select all, and then Empty Selected.
Next click Firefox [if you have that browser..] at the top, Select All again, and Empty Selected again. Follow that procedure also if you have Opera.
Close ATF.
=You must restart your computer in Safe Mode:
- press F8 several times while POST is running and before IDE detection completes.
- On the Windows Advanced Options Menu, select Safe Mode and press Enter.
- When the Boot Menu appears again, select Microsoft Windows XP and press Enter.
- Log in by using the Administrator account and password. NOTE: The password is blank by default unless you set a password.
=Open the extracted SDFix folder, C:\SDFix and double click RunThis.bat to start the script. Type Y to begin the cleanup.
You will be prompted to press any key to Reboot - the pc will then restart.
The tool will run again and complete the removal process then display Finished; press any key to end the script and load your desktop icons.
Once the desktop icons load the SDFix report …

Ryun, we need to look a little deeper then. Clean, then try the first, and then if your IE [it must be IE] will allow it, the second scan also.
==Get CCleaner from http://www.ccleaner.com/ - and install it in a new folder. You should keep this one for general use. I set the installation checkboxes only to open from the recycle bin. It's neater that way.
Now run CCleaner from the recycle bin rclick menu using its default settings [if you set up CCleaner as i suggested, rclicking the bin icon should give you the Open CCleaner option...].
If you have FireFox open the Applications tab and ensure at least that Cookies and Cache are checked.
Select the Cleaner icon, press Run Cleaner.
[For future quick temp file cleaning select the options you wish to use via the Windows and Applications tabs ..]
==Download this file to your desktop: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
- to run it dclick combofix.exe and follow the prompts to start it. When finished, it will produce a log, C:\Combofix.txt - post that log in your next reply.
A word of caution - do not touch your mouse/keyboard until the scan has completed. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs reboot to restore the desktop.
==Please use IE to do an online scan at panda:- http://www.pandasoftware.com/products/activescan?
-select a link to the scan... …

Nice. It looks all clear from my side of things.
Cheers, Kestrel.

I'll take a shot in the dark, tammy. Please do these things in this order.
==Get CCleaner from http://www.ccleaner.com/ - and install it in a new folder. You should keep this one for general use. I set the installation checkboxes only to open from the recycle bin. It's neater that way.
Now run CCleaner from the recycle bin rclick menu using its default settings [if you set up CCleaner as i suggested, rclicking the bin icon should give you the Open CCleaner option...].
If you have FireFox open the Applications tab and ensure at least that Cookies and Cache are checked.
Select the Cleaner icon, press Run Cleaner.
[For future quick temp file cleaning select the options you wish to use via the Windows and Applications tabs ..]
==Download this file to your desktop: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
- to run it dclick combofix.exe and follow the prompts to start it. When finished, it will produce a log, C:\Combofix.txt - post that log in your next reply.
A word of caution - do not touch your mouse/keyboard until the scan has completed. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs reboot to restore the desktop.
==Please use IE to do an online scan at panda:- http://www.pandasoftware.com/products/activescan?
-select a link to the scan... free online virus scan...., enter a valid? email and follow through, choosing My Computer for …

This should help:
==Download SmitfraudFix (by S!Ri) from http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Extract the content (a folder named SmitfraudFix) to your Desktop.
- Restart your computer in Safe Mode.
- Open the SmitfraudFix folder and double-click SmitfraudFix.cmd, select option #2 - Clean [type 2 and Enter]
You will be prompted: "Registry cleaning - Do you want to clean the registry?"; answer Y and Enter [which will remove the desktop background and clean registry keys associated with the infection].
The tool will next check if wininet.dll is infected- if it is you will be prompted to replace the file ; type Y and press "Enter".
It will also create a log named rapport.txt in the root of your drive, eg: Local Disk C:\
Restart in normal Windows.
[You may also have to restore your desktop background...
If so, go Start >run, type regedit and <enter>. Navigate to this key:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
Please export that key: in the left pane highlight system with a lclick, go File, export... , save as bluewall with file type .txt. Close regedit and post that txt file.]

==Start hijackthis, select Scan Only, place checkmarks against all the entries listed below that still exist, and then press Fix Checked.

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\mgmrwmrv.exe,
O2 - BHO: (no name) - {00000250-0320-4dd4-be4f-7566d2314352} - (no file)
O2 - BHO: (no name) - {13197ace-6851-45c3-a7ff-c281324d5489} - (no file)
O2 - BHO: (no name) - {15651c7c-e812-44a2-a9ac-b467a2233e7d} - (no …

Hello, ryun.
Delete this file:
C:\WINNT\System32\lgbpd.exe - if it is running just stop it in TM and then try to delete it again.
Good. Uninstall MyWebSearch via Add/Remove pgms.
Start hijackthis, select Scan Only, place checkmarks against all the entries listed below that still exist, and then press Fix Checked.

O4 - HKCU\..\Run: [LGBLiveUpdate] C:\WINNT\System32\lgbpd.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbar...4YYUS_ZZzer000
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/noc...1.0.0.15-3.cab

Finally: Java update!!! This is for security reasons. Go control panel > java > update, & press update now. Restart after

installing the update, and then go into control panel again, add/remove pgms and remove all old versions of java. Vsn 1.6.0.5 is current....
And let's hope that is it. Say how things are...

Sbilly, that would be a fine plan. Those drives do sound a little old so they may not be as fast as a modern drive but nevertheless your sys should show an improvement [although you likely will not notice it...]

Sbilly, the reason for having a paging file on a drive other than your system drive is because it is [or can be] quicker.... while the drive heads on the sys drive are working with files the other drive's heads can be accessing the page file. Depending upon what your sys is doing/running it may have easily a million page faults an hour [a page fault is just the name for a page file access operation] - you can see the saving through having another drive holding the page file. Why have it on the outside of your second drive? Well, the outer tracks just hold more info [there are far more sectors on an outer track than an inner one [don't think of pie wedges]], so there is less head movement needed, they rotate under the head faster too. To get the page file onto the outer tracks you just make it the first partition on that hd. A 1.5 or 2G partition would suffice, but realistically speaking, if the drive already has a lot of files on it you may not consider it worthwhile moving them to make room for another partition.... but if you wished to play with that idea you would copy the files to another partition, and then rearrange your first partition with a tool like GParted Live CD. [my pf is on the outer of a second hd]. Or you could add a third drive, but only if you had other uses for it... …

Borrow a cd... OEM or full licence, they will both types have a Recovery Console on them. And this is one problem where windows cannot fix itself simply because it cannot start.
You can also download a variety of bootable cd iso's which you can burn an image of, and use them to access your boot.ini file.
Good luck.... this problem does not call for either a reinstallation or a new computer. It is quite straightforward to fix if you have the tool, a bootable cd.

Jode, bootmgr is Vista, right? You might try the piggyback again but format using Windows XP, not Vista. Reason is that format clears the file tables, writes in the file system structure and the MBR for that partition. If you do a normal format that partition's disc structure is also checked for errors, whereas with a quick format it is not checked. These are both high level formattings. Neither of them are data erasures!
Are you certain you got the boot order correct? Try F11 during startup POST. Start the Recovery Console from your XP cd, format [quick or normal, no mater here] and fixboot.

The only way past your problem is to not try to boot your OS. It just will not start. You must use a bootable cd .. eg, your Xp installation cd is one such... there are others... and manually edit C:\boot.ini as I stated above.
If you boot with an XP installation cd Recovery Console is about your first choice available to you. Enter it and use the bootcfg command. Change the boot order by pressing F11 during startup and selecting your optical drive, eg CD/DVD, so that you may boot from the cd.

Lesson One. Do not use msconfig safeboot option when you have malware on board. If the malware has damaged the registry Safemode key your sys will not be able to enter Safe mode, it will reboot. And you won't be able to undo the Safeboot option.... but you know that now...
Msconfig Safeboot option modifies your boot.ini file. Use a bootable tool like Recovery Console to repair it with the bootcfg command, or slave the drive and edit it manually, or use a bootalbe tool which will allow you to access the C: root to edit boot.ini manually.
The edit is pretty obvious; in this sample boot.ini:
[boot loader]
timeout=4
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect /SAFEBOOT:MINIMAL(ALTERNATESHELL)
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

-you would simply delete the safeboot switch on the line where it occurs and save boot.ini.
Lesson Two: Don't believe all you read on websites.

Oops, wrong thread!!

Gee, nice, pointed and accurate reply by pushkar. Nothing beats experience....
Okay, file deletion.... try it in safe mode, or use this tool:
==This one is a general purpose deleter, Unlocker: http://filehippo.com/download_unlocker/
Dclick the exe to install it, unchecking the updater and assistant boxes. It runs from the rclick context menu, and that is cool.

Whoa there, a moment. Not taking umbrage at all here, that is not the purpose of this reply at all.... but f-Secure and Panda are extremely reputable companies with excellent products. I and others would not recommend their tools if we had any doubts about them. Both companies do also market comprehensive packages for security purposes, for both private and corporate markets - they are respected. The free online tools provided by them and other like companies are both a service to computer users and also to themselves - they are not at all interested in seeing malware and viruses proliferate from computers whose owners cannot/will not afford to disinfect them - viruses and trojans spead from such computers and give them and their paying clients more headaches.
Anyway... I strongly recommend that you run the f-secure tool. Strongly. There was a reason that I indicated it was needed; out of the plethora of tools available most are specialised, this one is. And the Panda scan is thorough - we here rely on it for virus cleaning and spyware detections, so do yourself a favour and run it. Think of it as a second opinion.
Encryption. A lot of malware is delivered in encrypted packages. Why? So scanners cannot easily recognise code strings.
If you do run them please do inform of the results.

Hey, hugh, couple bits of it are orright! N now we know caper's got a weight problem.

Thanks for the reply, blain, good to know the result. But seriously, we do not email help because we feel that others on search may lose a solution or otherwise, deadends and so forth. The site is a resource. Caper is a great asset here, and you did say you knew nothing about the innards of a machine...

No. Moreso, it recovers some disk errors.

Glad to hear it, Ken. The tools: definitely keep CCleaner, it is very handy to use fortnightly, say, esp if you set it up as I indicated I preferred.
Hijackthis and Combofix... you only need these tools when you can identify an actual problem exists, and in the case of Combofix know if it will be useful against it. Anyway, combofix will automatically timeout after about a week and uninstall itself if you try to use it. So remove them and their logs. Combofix has a remover built in which you can run... Go start, run and enter:
C:\downloads\combofix /u
Still leaves a few items tho. Combofix places its files in C:\... eg qoobox, the log, and builds a folder from which to run - you may just delete them manually. Hijackthis..? up to you, I think it is handy to keep a log fro reference.

Interesting, delphine. When you start your machine quite early on in the loading of Windows a program called Ntldr is in control; one of its last functions is to read in kernel files and the SYSTEM reg hive to see which drivers should be loaded. Pressing F8 to choose Safe Mode at this point results in a different registry key being used to specify a reduced set of drivers.
Now it so happens that the error code you are receiving is caused by a missing or bad hardware driver which is related to your your hd or IDE controllers, or a PCI bus driver [commonly called the chipset drivers..]. What that means is that when the system tries to change up a gear in its mode of accessing the hd, it just cannot. So it reports that the boot device is missing...
You obviously have those drivers because you can operate in Normal mode okay?, it must be that the reg key for the list of Safe Mode drivers is incorrect. Ways around that: If the problem does not date back too far you may be able to pick up a restore point that will solve it. Or you could get an old copy of the SYSTEM hive from Windows\repair using the recovery console [tedious]. Or you could update the drivers in Device Manager - catch is, I am not certain if trying this last will rewrite the necessary safe mode reg key
So... did restoring …

A good place to start would be:
Clean:
==Get CCleaner from http://www.ccleaner.com/ - and install it in a new folder. You should keep this one for general use. I set the installation checkboxes only to open from the recycle bin. It's neater that way.
Now run CCleaner from the recycle bin rclick menu using its default settings [if you set up CCleaner as i suggested, rclicking the bin icon should give you the Open CCleaner option...].
If you have FireFox open the Applications tab and ensure at least that Cookies and Cache are checked.
Select the Cleaner icon, press Run Cleaner.
==Download the file from this location, http://www.f-secure.com/tools/f-look2me.zip ; then as an administrator, unzip it and run the .exe. Reboot.
Scan for viruses..
==Please use IE to do an online scan at panda:- http://www.pandasoftware.com/products/activescan?
-select a link to the scan... free online virus scan...., enter a valid? email and follow through, choosing My Computer for a full system scan.
Post the log it produces here.
Scan for spyware:
==GET AVG antispyware 7.5 here.. http://free.grisoft.com/doc/5390/lng/us/tpl/v5
or here.. http://free.grisoft.com/freeweb.php/doc/5390/lng/us/tpl/v5#avg-anti-spyware-free
-Install it and UPDATE it.
Start AVG a-s 7.5;
-under Scanner/ Settings please change the default action from Recommended Actions to QUARANTINE, and run the complete system scan.
-press Apply all Actions and Save the log file. Post the log file.
If everything appears to …

Nothing to worry about there, Ken. [You've got busy, but good, kids.. :) ...I'm happy to take your word for it that you don't play Chicken Shoot and Rosso Rabbit.]
Start hijackthis, select Scan Only, place checkmarks against all the entries listed below that still exist, and then press Fix Checked.
O3 - Toolbar: (no name) - {2ECB7FB2-0333-416F-92FD-4904AD49252B} - (no file)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O23 - Service: iPodService - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
Good. These are not bad entries, merely ones which have been orphaned by file deletion.
I suggest you search for and delete GLB2.tmp; I imagine it will be in system32 or perhaps Windows directories, in any case search for it in \WINDOWS.
Say how your next Verizon installation attempt proceeds.

Okay, do let us know how things turn out.

Ken, I think you may have some malware on your computer... GLB2.tmp... so:
==Get CCleaner from http://www.ccleaner.com/ - and install it in a new folder. You should keep this one for general use. I set the installation checkboxes only to open from the recycle bin. It's neater that way.
Now run CCleaner from the recycle bin rclick menu using its default settings [if you set up CCleaner as i suggested, rclicking the bin icon should give you the Open CCleaner option...].
If you have FireFox open the Applications tab and ensure at least that Cookies and Cache are checked.
Select the Cleaner icon, press Run Cleaner.
==Download this file to your desktop: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
- to run it dclick combofix.exe and follow the prompts to start it. When finished, it will produce a log, C:\Combofix.txt - post that log in your next reply.
A word of caution - do not touch your mouse/keyboard until the scan has completed. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs reboot to restore the desktop.
==download hijackthis: http://www.majorgeeks.com/download5554.html
-copy it to a new FOLDER placed either alongside your program files or on your desktop and then... rename hijackthis .exe to imabunny.exe
-in that folder start HijackThis by dclicking the .exe; now close ALL other applications and any open windows including the explorer window containing HijackThis.
-click the Scan …

You have an instance of iexplore.exe for every IE window you have open. A blank window uses about 9 or 10 MB of memory, one with lots of site [or other] content will naturally use a lot more. That is the beauty of a tabbed browser like Opera or Firefox - only one process to handle all the various webpages you have open on tabs.

Go to Windows Update site and dl KB918118 into your desktop machine.

Although I am sure you have found them already, the three SD processes are: SDTrayApp.exe, svcntaux.exe, and swdsvc.exe
You can possibly stop it via the SD control panel, but ending those processes will do it also.
My advice is to stop SD from running, uninstall it and then reinstall.

Okay, I gotta try to help.... if your machine is actually still bootable then do this [this procedure will burn a diagnostic program onto a cd which in turn may be used to boot your machine and check the hd] :
== Checking A HDD That Will Not Load The OpSys

You'll need access to a computer with Internet connectivity and a CD burner, plus a blank CD-R or CD-RW.
Then go to this link: http://www.woyaa.com/cgi-bin/download/jump.cgi?ID=708646
or this link: http://support.thetechguys.com/Uploads/%7Bb4d5f239-78d9-4bd8-8e7a-2de1983b4d7d%7D/DiagCD23.exe
Either Run the file download or Save diagcd23.exe to your computer and dclick it to run. The procedure is quite automatic: you will be asked to insert a blank CD for burning the file.
Once the disk is created, put it in your broken machine, then restart it. It should boot from the CD and then give you the opportunity to run a Long HDD (hard disk) test. The utility supports a wide range of disk manufacturers.
Say how you get on.

If you do not see any BIOS activity at the beginning of boot, no list of disks or memory check then it is a bit dead, too dead for us to help you with it. Your not knowing anything about computers pretty much precludes us giving ideas about memory stick replacements or hdd checks.
Sorry, but caper is correct.

Have you tried uninstalling Spyware Doctor, if you are able to keep your sys running long enough? Stop it via Task Manager if you only have a brief chance to act. If ther is not time for even that before your sys crashes then you may have to use Recovery Console to remove its exe to stop it running.

ankit... when you computer does start and you have that blank screen it is probably because explorer.exe is not starting, or not continuing to run, or is corrupted. As a first step try going Ctr-Alt-Del to open Task Manager, go File, New Task, and type or paste in...
sfc /scannow
-insert your windows cd of the same upgrade level as your OS eg XP + SP2 and let it run.
You may also have malware.... come back when you get Windows Explorer working and we shall tackle that. You may also need spellcheck.

I take it that you replaced the config\SYSTEM file with repair\SYSTEM. What about SAM, SECURITY [and SOFTWARE, DEFAULT] files?
If you get it working you next have to get the most recent working registry hive from System Restore files [in System Volume Information]. You cannot just do a sys restore because the hive copied from \repair will not know about any restore points set after the \repair hive was originally saved.

"Speed: 3.0 MHz" ... that's your speed bottleneck, right there. Ida gone for one of the 3 GHz ones.... :)
Assuming disk space is not a problem, set a paging file of 1.5G. Got a second hard drive? Put it on that, first partition. Don't have one on the OS's disk as well, for XP one suffices.