hi,
i have been posting in adware and spyware forum and been asked to post here
ie:
Please post your latest HijackThis log.


Thereafter, the most productive actions may be to pursue a new thread in the XP FORUM because the behavior of Freezing and the Continuous Beep may be indicative of hardware failure issues (potentially CPU heat related) - as per observations made by jephree.
__________________
Vincent P
2100 malware fighting posts (and counting) - average 4/day


MALWARE: READ FIRST Procedures:
|_ SpyBot V1.4 _|_ Ad-Aware SE 1.06_|_ HijackThis LOG __V1.99.1 _|

hijack log below:

Logfile of HijackThis v1.99.1
Scan saved at 22:46:16, on 23/07/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wwSecure.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe
C:\WINDOWS\system32\ZoneLabs\isafe.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\AOL 9.0\waol.exe
C:\Program Files\AOL 9.0\shellmon.exe
C:\Program Files\Common Files\AOL\aoltpspd.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\Logitech\Video\FxSvr2.exe
C:\HJT\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=54729
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=56626&homepage=http://go.microsoft.com/fwlink/?LinkId=55245&clcid={SUB_CLCID}
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: 127.255.255.255 serial.alcohol-soft.com
O1 - Hosts: 127.255.255.255 images.alcohol-soft.com
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\VoyagerTest\fts.exe"
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NVRTCLK] C:\WINDOWS\system32\NVRTCLK\NVRTClk.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [AWMON] "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O15 - Trusted Zone: http://www.google.co.uk
O15 - Trusted Zone: http://*.xaraonline.com
O16 - DPF: {13EC55CF-D993-475B-9ACA-F4A384957956} (Controller Class) - https://www.windowsonecare.com/insta...SSWebAgent.CAB
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aolsvc.aol.co.uk/comput...up/qdiagcc.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1142614832207
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1142703421781
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} - http://messenger.msn.com/download/Ms...Downloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{636A6D98-F263-42C1-951C-5A7FF0CFC75F}: NameServer = 205.188.146.145
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSN Messenger\msgrapp.8.0.0792.00.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSN Messenger\msgrapp.8.0.0792.00.dll
O20 - Winlogon Notify: RegCompact - C:\WINDOWS\SYSTEM32\RegCompact.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Washer Security Access (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe

Issues were currently being addressed in the following thread:

http://www.d-a-l.com/help/showthread.php?t=44395

Is this a new problem? Were things working OK previously? Any new hardware and or software?

I notice a lot of video programs. Does this freeze only happen when you are using video software?

Does the beep always go with a freeze?

Can you run the computer without video apps and without freezing?

I would monitor the Task Manager for CPU usage as you work.

Also download the old free Everest and check your CPU temperature (Computer > Sensor):

http://www.oldversion.com/program.php?n=everesthome



Also: look in your Event viewer: rt. click My Computer then click Manage then Event Viewer.
Or: Administrative Tools/Event Viewer or Start/Run/ eventvwr
Open the system as well as the application tabs & look for X errors. Click error line for details.
Post back the source & event id & Description especially of errors that seem to coincide with this issue.
Also check the Information lines that might coincide with this issue.

How to view and manage event logs in Event Viewer in Windows XP

yes this is a new problem,things have beeen working great new processer 6months ago,+motherboard,freeze happening after about ten mins on or so,i have had new software called 'onecare from microsoft since having this cant uninstall either and only happened when i tried to unistall this?no the beep only happened once but freezes happening alot,i can run pc without being on internet fine?i have looked at event viewer,system logs,and theres two main errors
source:service control manager
catergory:none
event id: 7000

source:srv
catergory:none
event id:2000

cpu temp is approx 37c

also there is no Continuous Beep ! seems like a configuation problem or brouser ?since once is still on and now zone alarm cant get one care unistalled?

event viewer

source:SideBySide
catergory:none
event id: 59

this error too

hi ihave left my pc running for 3hrs now no freezes+cpu temp hasnt gone up still 37c...this only happens when on internet,could this be a configuation probelm as that one care i cant delete folder in programs folder and wont unistall?

when i said 3hrs i mean 3hrs without being on the internet....just unistalled aol and reinstalled.....got on internet drpopped aol using internet explore works fine then use or start a program and freeze's again ...?

I would suggest trying a System Restore to a point prior to the installation of Windows Live OneCare.

The installation of this software should have created a Restore Point.

start > All Programs > Accessories > System Tools > System Restore


Make sure that Windows Live OneCare and Zone Alarm are turned off.


If this fails you might try the System Restore in Safe Mode.


If this fails we can try to manually remove this software.

Uninstall Programs Manually

Just because Windows XP has the Add/Remove Programs feature it doesn't mean your application will appear in the list. Furthermore, even if it does appear, it's no guarantee that the uninstall feature will work. When you run across one of these situations the items listed below will help in getting rid of the application. Be aware that these steps may not remove everything associated with the application and can impact other applications on the computer. Have a backup or restore point and use caution.

*

Find the directory for the application and delete all the files in the directory. Delete the directory. e.g. click C: under My Computer then Program Files etc.
*

Open regedit (start/run regedit) and navigate to HKEY_LOCAL_MACHINE\SOFTWARE and find the folder for the application. Delete the folder.
*

Open regedit and navigate to HKEY_CURRENT_USER\SOFTWARE and find the folder for the application. Delete the folder.
*

To remove the application entry from Add/Remove Programs (if present) open regedit and navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall and find the folder for the application. Delete the folder.
*

Some applications have Services attached to them. If this is the case, navigate to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servic es, locate and delete the service.
*

In Windows Explorer, navigate to the individual user settings and delete program references. Common places to check would be:

C:\Documents and Settings\All Users\Start Menu\Programs and delete relevant entries.
C:\Documents and Settings\All Users\Start Menu\Programs\Startup and delete relevant entries.
C:\Documents and Settings\%YourUserID%\Start Menu\Programs and delete relevant entries.
[Do this for each User ID listed]
C:\Documents and Settings\%YourUserID%\Start Menu\Programs\Startup and delete relevant entries.
[Do this for each User ID listed]

If no entries were found in the previous step and the application launches automatically, navigate to
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
and delete the entry.

A good free Registry Cleaner here: RegSeeker

It is a good idea to backup your Registry before cleaning. This is a good free tool for that:

[ERUNT] Registry Backup and Restore for Windows
http://www.larshederer.homepage.t-online.de/erunt/


[ERUNT Download URLs]
http://www.aumha.org/downloads/erunt.zip
http://www.aumha.org/downloads/erunt-setup.exe


[Installing & Using ERUNT]
http://www.winxptutor.com/regback.htm
http://www.silentrunners.org/sr_eruntuse.html
http://www.larshederer.homepage.t-on...runt/erunt.txt


....................................

Altering system files; & or modifying the registry can be risky and D-A-L.com and its members cannot accept liability for any adverse effects caused by following advice freely given on this site.

....................................

If the problems persist you might consider a Repair Install of XP.

http://michaelstevenstech.com/XPrepairinstall.htm

thankyou very much for your help d-a-l...i finaly got this sorted out ....it was Windows Live OneCare,i emailed microsoft onecare newsgroup and they sent me back a removal tool for onecare you can get here just incase others have this same problem ok

http://download.microsoft.com/downlo...areCleanup.exe

so much for trial products eh?

anyway this thread can be closed cheers d-a-l