Svchost.exe application error 0x37001160 [Resolved]

Unknown
edited October 2006 in Spyware & Virus Removal
Hello, I have read a thread under this section regarding something similar to my problem. I get the following error msg when my computer starts up: The isntruction at "0x37001160" referenced memory at "0x37001160". The memory could not be "written". Click okay to terminate the program, click cancel to debug the program.

The next window to pop up says something about C://windows/system32/services.exe, status code 1073741819. It automatically restarts and goes through the same thing. I did try to start in safe mode and that worked. I tried a restore point, but it only gave me one 15 minutes prior to problem. Nothing farther back. I just shut it down and went to bed last night.

I've read several sites that seem to think it has something to do with McAffee virus protection. This is on my home computer that is used for pleasure and working from home for my company. I am currently at work and will only be able to work on it at home this coming weekend.

What do I need to do and WHERE DO I START TO FIX THE PROBLEM???? I have no computer experience to fix problems. I normally take it to Best Buy and pay them to fix it. But I thought I would try this first. PLEASE HELP!!!!!

Thank you,
tigerjanet

Comments

  • skywalker45skywalker45 Bloomington, IN. USA
    edited September 2006
    I take it from your post that you cannot start this PC in normal mode, correct? But safe mode works, correct? Please let me know and I'll see what we can do.
  • skywalker45skywalker45 Bloomington, IN. USA
    edited September 2006
    OK. While you're at work today and if your boss doesn't care (obviously) please download the following programs:

    Download Hijack This from here:

    http://www.short-media.com/download.php?dc=69&p=3

    And download the Sasser worm removal tool from here:

    http://www.symantec.com/security_response/writeup.jsp?docid=2004-050114-1706-99

    Burn these programs to CD or if they're small enough they may fit on a floppy. You need to take them home to your infected PC and copy them both to the desktop (you can do this in safe mode).

    Next unzip Hijack This to your desktop. Leave it there for now.

    Next please run the Sasser worm removal tool. Once the tool finishes see if you can boot into normal mode. If you can then run Hijack This and click the button that says do a system scan and save a log file. If you can't get to normal mode then run Hijack This anyway.

    The log will open in Notepad. Please post the entire contents of the log here in your next reply.

    If you have a second computer at home (or a friend's PC) you could do this from there instead of from work.
    :)
  • tigerjanet
    edited September 2006
    Hi Skywalker, I am able to start my computer in safe mode w/networking. I downloaded Sasser worm removal and Hijackthis. Thanks SO MUCH for your help.

    Here's results:

    C:\System Volume Information: (not scanned)
    W32.Sasser.Worm has not been found on your computer.

    I restarted computer and it would not start. Got same error msg. So I ran Hijackthis scan. Here are results:

    Logfile of HijackThis v1.99.1
    Scan saved at 9:51:25 PM, on 9/29/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us10.hpwis.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us10.hpwis.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us10.hpwis.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us10.hpwis.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us10.hpwis.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us10.hpwis.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us10.hpwis.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us10.hpwis.com/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://us10.hpwis.com/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = proxy-mem-vpn.network.fedex.com
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R3 - Default URLSearchHook is missing
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\program files\hp\digital imaging\bin\hpdtlk02.dll
    O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe"
    O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
    O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
    O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /installquiet /keeploaded /nodetect
    O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
    O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
    O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe"
    O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
    O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [Sunkist2k] "C:\Program Files\Multimedia Card Reader\shwicon2k.exe"
    O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
    O4 - HKLM\..\Run: [SmcService] "C:\PROGRA~1\Sygate\SSA\smc.exe" -startgui
    O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
    O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
    O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
    O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [BackupNotify] "c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe"
    O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0a\AOL.EXE" -b
    O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
    O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
    O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
    O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
    O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.infuzer.com/IDC/client/player/isetup.cab
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = corp.ds.fedex.com,prod.fedex.com
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
    O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
    O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
    O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
    O23 - Service: Lan Discover Agent (magaService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SSA\maga\maga.exe
    O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
    O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\mcshield.exe
    O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: Sygate Security Agent (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SSA\smc.exe
    O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
    O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
  • skywalker45skywalker45 Bloomington, IN. USA
    edited September 2006
    Well a log in safe mode is better than no log at all:D

    Since you have internet access please download CWShredder from my signature below. Install the program to your desktop. Follow the instructions below to run it and note that you will need to check for updates to the program before you run it:
    • Open CWShredder.exe.
    • Click "Fix ->" and click "OK" at the prompt.
    • CWShredder will scan and clean your system of CWS files.
    • Click "Next->" and then "Exit".

    Next run Hijack This again and put a check (tick) next to the following entries:


    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us10.hpwis.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us10.hpwis.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us10.hpwis.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us10.hpwis.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us10.hpwis.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us10.hpwis.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us10.hpwis.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us10.hpwis.com/

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://us10.hpwis.com/

    R3 - Default URLSearchHook is missing


    Close all open browsers/windows and click Fix Checked. Close Hijack This. Reboot the PC into safe mode with networking again and run a scan with Hijack This and post the new log in your next reply.
  • tigerjanet
    edited September 2006
    Hi Skywalker, done as instructed. Following is most recent Hijackthis scan from Sat morning. Thanks for your help.

    Logfile of HijackThis v1.99.1
    Scan saved at 10:45:43 AM, on 9/30/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
    C:\WINDOWS\system32\userinit.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = proxy-mem-vpn.network.fedex.com
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\program files\hp\digital imaging\bin\hpdtlk02.dll
    O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe"
    O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
    O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
    O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /installquiet /keeploaded /nodetect
    O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
    O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
    O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe"
    O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
    O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [Sunkist2k] "C:\Program Files\Multimedia Card Reader\shwicon2k.exe"
    O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
    O4 - HKLM\..\Run: [SmcService] "C:\PROGRA~1\Sygate\SSA\smc.exe" -startgui
    O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
    O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
    O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
    O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [BackupNotify] "c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe"
    O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0a\AOL.EXE" -b
    O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
    O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
    O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
    O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
    O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.infuzer.com/IDC/client/player/isetup.cab
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = corp.ds.fedex.com,prod.fedex.com
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
    O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
    O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
    O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
    O23 - Service: Lan Discover Agent (magaService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SSA\maga\maga.exe
    O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
    O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\mcshield.exe
    O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: Sygate Security Agent (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SSA\smc.exe
    O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
    O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
  • skywalker45skywalker45 Bloomington, IN. USA
    edited September 2006
    OK, that's good. The CWS is gone. Can you boot into normal mode now?
  • tigerjanet
    edited September 2006
    Hi skywalker45, I tried restarting in normal mode and got the same error msg as first noted above. What next??? Thanks, tigerjanet
  • skywalker45skywalker45 Bloomington, IN. USA
    edited September 2006
    I've been researching this and will continue to, but first let me ask another question. When you tried system restore you said it gave you only a restore point from 15min ago, correct? Were you using system restore from the start menu or were you booting and then using last known good configuration that worked.

    I'll be offline for about an hour after this post but I will come back and check your answer.
  • tigerjanet
    edited September 2006
    Hi skywalker, I'm on my husbands laptop now. I was using the system restore from the start menu. It came up when I started in safe mode.

    I have not tried "last known good configuration that worked" from the safe mode startup screen. I'll start up my computer again and check back in a few minutes. I hope you can help me. I use the computer for telecomuting. I work at home several days a week for FedEx and can't afford for this to happen. I'm ready to go buy a new one soon if I can't get it up and running.

    I talked to my husband more about what happened and he was reading aol email when he opened something and this all started. He didn't call me when all the error msgs windows popped up so I don't know exactly what they said. He just clicked them off. Thanks, tigerjanet
  • skywalker45skywalker45 Bloomington, IN. USA
    edited September 2006
    OK. I'll wait for your response. Read this:

    http://www.therushforum.com/index.php?showtopic=16015

    It talks about this problem and how it might be AOL related. The very worst that could happen here is a repair install of the operating system if you have the Windows CD. In that case I might refer you to the emergency help forum.
  • tigerjanet
    edited September 2006
    Hi skywalker: I tried restarting with last known good configuration that worked and got the same error message. Any other thoughts? It's interesting how this happened all of a sudden. We've been using AOL for many, many years with no problems. Thanks, tigerjanet
  • skywalker45skywalker45 Bloomington, IN. USA
    edited September 2006
    I don't believe it's being caused by Malware. I believe something in the system files got corrupt somehow. Without being able to see a full log in normal mode I can't be sure though. One other thing we could try before I refer you to the other forum is this:

    Click Start--->Run

    In the run box type:

    sfc /scannow

    Be sure to type it verbatim, just like it is above and don't forget the space after the "sfc". This will check the system files against original system files and make sure they're intact. If something is wrong it will let you know. Run this and post back your findings.
  • tigerjanet
    edited September 2006
    Hi Skywaler, I typed sfc /scannow in the Run window and clicked okay. A black window popped up for a split second and then closed. That was it.
  • skywalker45skywalker45 Bloomington, IN. USA
    edited September 2006
    This might be due to you only being able to operate in safe mode. I'm going to contact the moderator at the emergency help forum and we might move your post there. However it works out we'll continue to try to help.
    :)
  • tigerjanet
    edited September 2006
    Thanks so much. In proceess of backing up all my files. I will not be back on until Sunday morning around 8 am pt.

    Thanks, tigerjanet
  • profdlpprofdlp The Holy City Of Westlake, Ohio
    edited September 2006
    skywalker45 has you on the right track, with one little change:

    Click Start>>Run, then type in cmd and click "OK". After that, proceed by typing the sfc /scannow command in the black & white window which should have appeared after you did the first part. Make sure you have your Windows CD in the drive before you start; if any files need to be repaired or replaced it will grab them from there.

    Good luck. :)
  • tigerjanet
    edited October 2006
    Hi profdlp: I did as you instructed in run window and had recovery cd (I have 6 recovery cd's) in cd drive and received the following msg:

    Microsoft Windows XP {Version 5.1.2600)
    <C> Copyright 1985-2001 Microsoft Corp.

    C:\Documents and Settings\Owner>sfc \scannow
    Windows File Protection could not initiate a scan of protected system files.

    The specific error code is 0x000006ba {The RPC server is unavailable.}

    I tried again and got the same error message.

    I also ran a virus scan of my system. Let me know if you wnat to see the log. I just don't know what else to do. I need this to work at home this next week. Any more suggestions?

    Thanks, tigerjanet
  • profdlpprofdlp The Holy City Of Westlake, Ohio
    edited October 2006
    Go to Start>>All Programs and look for a folder called Administrative Tools, then click on Computer Management. Click the plus sign next to Services and Applications, then click on the word Sevices on the left-hand side. Look through the list of services (on the right side) and make sure that the Remote Procedure Call (RPC) service is set to "Automatic" and is started. Then try it again. :)
  • tigerjanet
    edited October 2006
    Hi prof. I found the folder by search. Status was already set to start and startup type is auto. I'll restart now.

    Thansk,tigerjanet
  • tigerjanet
    edited October 2006
    Good morning Skywalker and Prof, I gave up and initiated a system recover. It worked and computer is running good. Have loaded all windows updated, now have to work on software. Thanks so much for all your help.

    Tigerjanet
  • skywalker45skywalker45 Bloomington, IN. USA
    edited October 2006
    You're welcome tigerjanet. I'm sorry you had to do the recover. Sometimes these things happen and they're not always related to malicious software. Something similar to this happened to me a couple of years back and I had to do a clean install of Windows. I'm just glad you're back up. I'll leave the post open for now in case Prof has anything to add.
  • profdlpprofdlp The Holy City Of Westlake, Ohio
    edited October 2006
    Sometimes the "hard" way is easiest in the end.

    Good luck from here on out. :wave:
  • skywalker45skywalker45 Bloomington, IN. USA
    edited October 2006
    And there you have it tigerjanet. If you require additional assistance please start a new thread.
This discussion has been closed.