[AdvancedSetup]

Here is an example of saving the file from Event Viewer.
I will be leaving for a couple weeks, but one of the other users or moderators should be able to take a look and hopefully help you out with it.

[AdvancedSetup]

Sorry Zim, this is an example for an XP system.

Your system though is quite similar for Vista except the file format extension is different. There should also be an option to export it as text that can be used, but due to the size it will need to be zipped up still.

[zism]

hi - thanks and have a good holiday

have only managed to attach one file as the other is too large (2.93)

[zism]

woops it appears bot zip files are too large!!

[AdvancedSetup]

Maybe try uploading them to a free file transfer site like Rapidshare.com

www.rapidshare.com

They will then give you a link to where the file is saved and post that link back here. I'm leaving for vacation as said, so hopefully one of the other guys can help you out while I'm gone.

[zism]

hope this is right!

RapidShare: Easy Filehosting
RapidShare: Easy Filehosting

thanks again for your help, and have a great holiday

[AdvancedSetup]

Yes, those are the correct files. Thanks. Sorry I don't have time to review them for you though.

Randy or someone with VISTA please download these files and review them for errors on the system and possible solutions for a fix.

Thanks and I'll see you guys in a couple weeks.

[RandyL]

The following is a partial list of the Event Viewer log warnings and errors. I only went back about eight days.

Application log errors and warnings. The first two (User Profile Service) are persistent.

WARNING
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.
DETAIL -
2 user registry handles leaked from \Registry\User\S-1-5-21-1646508940-1937668409-2531279105-1000_Classes:Process 1016 (\Device\HarddiskVolume2\Windows\System32\svchost. exe) has opened key \REGISTRY\USER\S-1-5-21-1646508940-1937668409-2531279105-1000_CLASSES Process 3764 (\Device\HarddiskVolume2\Windows\System32\wuauclt. exe) has opened key \REGISTRY\USER\S-1-5-21-1646508940-1937668409-2531279105-1000_CLASSES

WARNING
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.
DETAIL -
1 user registry handles leaked from \Registry\User\S-1-5-21-1646508940-1937668409-2531279105-1000:Process 1016 (\Device\HarddiskVolume2\Windows\System32\svchost. exe) has opened key \REGISTRY\USER\S-1-5-21-1646508940-1937668409-2531279105-1000

WARNING
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.
DETAIL -
3 user registry handles leaked from \Registry\User\S-1-5-21-1646508940-1937668409-2531279105-1000:Process 1000 (\Device\HarddiskVolume2\Windows\System32\svchost. exe) has opened key \REGISTRY\USER\S-1-5-21-16465089401937668409-2531279105-1000Process 5164(\Device\HarddiskVolume2\Windows\System32\wuau clt.exe) has opened key \REGISTRY\USER\S-1-5-21-1646508940-1937668409-2531279105-1000Process 5164 (\Device\HarddiskVolume2\Windows\System32\wuauclt. exe) has opened key \REGISTRY\USER\S-1-5-21-1646508940-1937668409-2531279105-1000\Software\Microsoft\Windows\CurrentVersion\Exp lorer ERROR
The program iexplore.exe version 7.0.6000.16681 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: 6f8 Start Time: 01c8e5edf12a155e Termination Time: 17

WARNING
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.
DETAIL -
2 user registry handles leaked from \Registry\User\S-1-5-21-1646508940-1937668409-2531279105-1000_Classes: Process 1020 (\Device\HarddiskVolume2\Windows\System32\svchost. exe) has opened key \REGISTRY\USER\S-1-5-21-1646508940-1937668409-2531279105-1000_CLASSES
Process 1772 (\Device\HarddiskVolume2\Windows\System32\spoolsv. exe) has opened key \REGISTRY\USER\S-1-5-21-1646508940-1937668409-2531279105-1000_CLASSES\Local
Settings\Software\Microsoft\Windows\Shell\MuiCache

WARNING
msnmsgr (3588)
\\.\C:\Users\owner\AppData\Local\Microsoft\Messeng er\**********@hotmail.com\ EDIT: Email Address Removed for Security Reasons.
SharingMetadata\Working\database_AE70_E5E0_70E5_AE F1\dfsr.db: A request to read from the file
"Sign In
\SharingMetadata\Working\database_AE70_E5E0_70E5_A EF1\dfsr.db" at offset 319488 (0x000000000004e000) for 8192 (0x00002000) bytes succeeded, but took an abnormally long time (210 seconds) to be serviced by the OS. This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem.

ERROR
Faulting application iexplore.exe, version 7.0.6000.16681, time stamp 0x48113d17, faulting module ntdll.dll, version 6.0.6000.16386, time stamp 0x4549bdc9, exception code 0xc0000374, fault offset 0x000af1c9, process id 0x22c, application start time 0x01c8e50389dc18a1.

ERROR
Faulting application AdobeUpdater.exe, version 5.1.0.1082, time stamp 0x45e646c6, faulting module AdobeUpdater.exe, version 5.1.0.1082, time stamp 0x45e646c6, exception code 0xc000000d, fault offset 0x001665e8, process id 0x14ec, application start time 0x01c8e1deb32f0907.

System log warnings and errors.

ERROR
IRQARB: ACPI BIOS does not contain an IRQ for the device in PCI slot 5, function 0. Please contact your system vendor for technical assistance.

ERROR
IRQARB: ACPI BIOS does not contain an IRQ for the device in PCI slot 6, function 0. Please contact your system vendor for technical assistance.

WARNING
WLAN AutoConfig service has successfully stopped.

WARNING
Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 0016E3DAF845. The following error occurred:
The operation was canceled by the user.. Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.

ERROR
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{A47979D2-C419-11D9-A5B4-001185AD2B89} to the user owner-PC\owner SID (S-1-5-21-1646508940-1937668409-2531279105-1000) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.

WARNING (Multiple instances on July 11)
Windows Servicing identified that package KB936330(Service Pack) is not applicable for this system

WARNING (Multiple instances on July 11)
Servicing has required reboot to complete the operation of setting package KB955020(Update) into Install Requested(Install Requested) state

WARNING
Windows Servicing identified that package KB955020(Update) is not applicable for this system

WARNING (Multiple instances on July 10)
Servicing has required reboot to complete the operation of setting package KB950582(Security Update) into Install Requested(Install Requested) state

WARNING (Multiple instances on July 10 and 9)
Windows Servicing identified that package KB950582(Security Update) is not applicable for this system

WARNING
Windows Servicing identified that package KB905866(Update) is not applicable for this system

WARNING (persitent)
An error was detected on device \Device\CdRom0 during a paging operation.

[zism]

thanks .... what does all that mean?!

[RandyL]

I don't know either zism. I haven't found anything by googling. I was hoping someone would know if there was something that stood out.

In the mean time let me summarize some of the steps so far.
1. You ran the malware scans correct?
2. You disabled the requested items under the startup tab in msconfig correct?
3. It runs fine in safemode with networking correct?
4. You did not unzip and check the drive with the utility from Samsung correct?

To unzip the utility right click the folder and click Extract All. If the drive passes then it's likely a startup item or malware.

A common problem with startup items is multiple antivirus programs or firewalls. Are you using PCGuard and Authentium at the same time. Are you using the PCGuard firewall and the Windows firewall at the same time? PCGuard from Virgin Media has been known to cause issues. Have you tried uninstalling it?

Before you ran the malware scans did you disable Tea Timer in SpyBot?

Uninstall Torrentman.

[zism]

1. yes I ran malware scans correctly
2. yes disabled requested items in msconfig
3. yes works fine in safemode
4. yes I did not unzip and check the drive with the samsung utility

are you saying I should try an uninstall VIrgin Media PC Guard completely? that would leave me with no anti virus/spyware facility

[RandyL]

I would wait for advice from the techs zism. You put out the information so let them look it over.

I have no idea if PcGuard is the issue and would never recommend running without protection. Like I said though if for some reason you have two AV programs or firewalls running that could be an issue.

[Kelly]

Originally Posted by zism

are you saying I should try an uninstall VIrgin Media PC Guard completely? that would leave me with no anti virus/spyware facility

When you booted to Safe Mode with Networking, you were running without anti-virus/spyware protection. I think at this point, you need to evaluate the risk of running unprotected for a short time to check to see if PC Guard is causing the problem.

Maybe I missed it, but is this machine slow all the time or just when on the Internet. If it's slow all the time, then disconnect the Internet cable and remove PC Guard. If that fixes the problem, then you know the cause and can install something else.

[zism]

hi
was wondering if anyone has had a chance to look over those files yet?
thanks
zism

[Goku]

Sorry for the delay Zism as our Malware experts have been offline. I will get back to you after I review the whole thread. Please hang in there and do not lose heart.

-- Goku

[Goku]

OK, from what I have gathered, you have not been asked to list your system specifications. Lets try to start with this and see if it can shed any light on your problem.

Please download the following utility and perform the below instructions.

System Spec

1. Download the executable version of the program and save it to your desktop.
2. Open the utility and you will see a list of your system specifications.
3. Click on the Edit toolbar and select Copy to Clipboard Ctrl + C.
4. Press Ctrl + V to post the specifications in your next reply.

Please post the required information as soon as possible.

-- Goku

[zism]

hi

could not run this scan. It siad my firewall was blocking it and asked me to temporarily turn it off. I did this and same problem!! any ideas?

[Goku]

What firewall are you using?

-- Goku

[Seth]

I doubt the drive is failing since it's fine in Safe Mode.

I'd try what Kelly suggested:

When you booted to Safe Mode with Networking, you were running without anti-virus/spyware protection. I think at this point, you need to evaluate the risk of running unprotected for a short time to check to see if PC Guard is causing the problem.

Otherwise, I'd back up any important data and reinstall Vista.

[zism]

Im using PC Guard's firewall
zism