Blue screen of death

[QuietCowboy]

Help.

I keep getting a system crash and the blue screen of death. I set Dr watson to record the errors also. Here is my log from HJT. Can someone please help and let me know if there is something I need to delete or set different.

Logfile of HijackThis v1.97.7
Scan saved at 3:02:16 PM, on 10/25/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\PROGRA~1\Lavasoft\AD-AWA~2\Ad-Watch.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Xfire\Xfire.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\wuauclt.exe
C:\UnrealTournament\System\UTSpy.exe
C:\DOCUMENTS AND SETTINGS\DOUG\MY DOCUMENTS\My Downloads\HijackThis.exe
C:\Program Files\Yahoo!\Messenger\ypager.exe

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [POINTER] C:\Program Files\Microsoft Hardware\Mouse\point32.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [AWMON] "C:\PROGRA~1\Lavasoft\AD-AWA~2\Ad-Watch.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O10 - Broken Internet access because of LSP provider 'xfire_lsp_9425.dll' missing
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/fu....0.0.8.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/yinst/yinst_current.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.c...mplete.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/sh...wflash.cab

[Geekgirl]

Hello QuietCowboy

You have d/l an old version of HJT. Please Download the newer version of and post a new logfile in here.

[Restek]

[QuietCowboy]

[Geekgirl]

The link to HJT was in my reply. Sorry you missed it. Here it is again.


You can cut and paste Dr. Watson in here along with your new logfile to let the moderators have a look at it.

[QuietCowboy]

Oh i see now. If I would have waved my mouse over it I would have seen it.Here is the new log.

Logfile of HijackThis v1.98.2
Scan saved at 10:03:34 PM, on 10/25/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\PROGRA~1\Lavasoft\AD-AWA~2\Ad-Watch.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Xfire\Xfire.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\wuauclt.exe
C:\UnrealTournament\System\UTSpy.exe
C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
C:\Ventrilo\Ventrilo.exe
C:\Program Files\Yahoo!\Messenger\ypager.exe
C:\Program Files\HijackThis\HijackThis.exe

O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\2.bin\MWSSRCAS.DLL
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [POINTER] C:\Program Files\Microsoft Hardware\Mouse\point32.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [AWMON] "C:\PROGRA~1\Lavasoft\AD-AWA~2\Ad-Watch.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe
O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\2.bin\MWSOEMON.EXE
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\2.bin\MWSOEMON.EXE
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZN
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Broken Internet access because of LSP provider 'xfire_lsp_9425.dll' missing
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/fu ... .0.0.8.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.c ... mplete.cab

*************************************************************************************************
Dr Watson file


Microsoft (R) DrWtsn32
Copyright (C) 1985-2001 Microsoft Corp. All rights reserved.



Application exception occurred:
App: C:\Ventrilo\Ventrilo.exe (pid=2272)
When: 10/20/2004 @ 19:46:18.095
Exception number: c0000005 (access violation)

*----> System Information <----*
Computer Name: DOUG-O589URAPR1
User Name: Doug
Terminal Session Id: 0
Number of Processors: 1
Processor Type: x86 Family 6 Model 6 Stepping 2
Windows Version: 5.1
Current Build: 2600
Service Pack: 1
Current Type: Uniprocessor Free
Registered Organization:
Registered Owner: Doug

*----> Task List <----*
0 System Process
4 System
460 smss.exe
520 csrss.exe
544 winlogon.exe
588 services.exe
608 lsass.exe
780 svchost.exe
836 svchost.exe
952 svchost.exe
1012 svchost.exe
1232 Explorer.EXE
1244 ccSetMgr.exe
1292 SNDSrvc.exe
1336 ccEvtMgr.exe
1500 spoolsv.exe
1640 sstray.exe
1692 InCD.exe
1792 Ad-Watch.exe
1804 RUNDLL32.EXE
1836 Xfire.exe
268 InCDsrv.exe
392 navapsvc.exe
420 NPFMntor.exe
480 ymsgr_tray.exe
524 NPROTECT.EXE
828 nvsvc32.exe
1064 nopdb.exe
1100 symlcsvc.exe
2200 UTSpy.exe
2224 ventrilo_srv.exe
2272 Ventrilo.exe
2372 UnrealTournament.exe
2588 wuauclt.exe
940 drwtsn32.exe

*----> Module List <----*
(0000000000400000 - 000000000049a000: C:\Ventrilo\Ventrilo.exe
(0000000000b60000 - 0000000000b7c000: C:\Program Files\Xfire\xfire_conure_9717.dll
(0000000000b90000 - 0000000000b9e000: C:\WINDOWS\System32\xfire_lsp_9425.dll
(0000000010000000 - 000000001002f000: C:\Program Files\Xfire\xfire_toucan_9717.dll
(0000000058300000 - 0000000058308000: C:\WINDOWS\System32\msgsm32.acm
(0000000058330000 - 0000000058335000: C:\WINDOWS\System32\msg711.acm
(0000000058420000 - 0000000058427000: C:\WINDOWS\System32\imaadp32.acm
(000000005ad70000 - 000000005ada4000: C:\WINDOWS\System32\uxtheme.dll
(000000005d090000 - 000000005d13c000: C:\Program Files\Common Files\Microsoft Shared\Speech\sapi.dll
(000000005edd0000 - 000000005edea000: C:\WINDOWS\System32\OLEPRO32.DLL
(00000000688f0000 - 00000000688f9000: C:\WINDOWS\System32\HID.DLL
(000000006ce10000 - 000000006ce45000: C:\WINDOWS\System32\DINPUT8.dll
(0000000070a70000 - 0000000070ad4000: C:\WINDOWS\system32\SHLWAPI.dll
(0000000071950000 - 0000000071a34000: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.10.0_x-ww_f7fb5805\comctl32.dll
(0000000071a50000 - 0000000071a8b000: C:\WINDOWS\System32\mswsock.dll
(0000000071a90000 - 0000000071a98000: C:\WINDOWS\System32\wshtcpip.dll
(0000000071aa0000 - 0000000071aa8000: C:\WINDOWS\System32\WS2HELP.dll
(0000000071ab0000 - 0000000071ac5000: C:\WINDOWS\System32\WS2_32.dll
(0000000072cf0000 - 0000000072cf6000: C:\WINDOWS\System32\msadp32.acm
(0000000072d10000 - 0000000072d18000: C:\WINDOWS\System32\msacm32.drv
(0000000072d20000 - 0000000072d29000: C:\WINDOWS\System32\wdmaud.drv
(0000000073000000 - 0000000073023000: C:\WINDOWS\System32\WINSPOOL.DRV
(00000000732e0000 - 00000000732e5000: C:\WINDOWS\System32\RICHED32.DLL
(0000000073ee0000 - 0000000073ee4000: C:\WINDOWS\System32\KsUser.dll
(0000000073f10000 - 0000000073f65000: C:\WINDOWS\System32\DSOUND.dll
(0000000074d30000 - 0000000074d50000: C:\WINDOWS\System32\oledlg.dll
(0000000074e30000 - 0000000074e9a000: C:\WINDOWS\System32\RICHED20.dll
(0000000075f40000 - 0000000075f5f000: C:\WINDOWS\system32\Apphelp.dll
(00000000760f0000 - 000000007616a000: C:\WINDOWS\system32\urlmon.dll
(00000000763b0000 - 00000000763f5000: C:\WINDOWS\system32\comdlg32.dll
(0000000076670000 - 0000000076757000: C:\WINDOWS\System32\SETUPAPI.DLL
(0000000076780000 - 0000000076788000: C:\WINDOWS\System32\SHFOLDER.dll
(0000000076b40000 - 0000000076b6c000: C:\WINDOWS\System32\WINMM.dll
(0000000076f20000 - 0000000076f45000: C:\WINDOWS\System32\DNSAPI.dll
(0000000076f60000 - 0000000076f8c000: C:\WINDOWS\system32\WLDAP32.dll
(0000000076f90000 - 0000000076fa0000: C:\WINDOWS\System32\Secur32.dll
(0000000076fb0000 - 0000000076fb7000: C:\WINDOWS\System32\winrnr.dll
(0000000076fc0000 - 0000000076fc5000: C:\WINDOWS\System32\rasadhlp.dll
(0000000076fd0000 - 0000000077048000: C:\WINDOWS\System32\CLBCATQ.DLL
(0000000077050000 - 0000000077115000: C:\WINDOWS\System32\COMRes.dll
(0000000077120000 - 00000000771ab000: C:\WINDOWS\system32\OLEAUT32.dll
(00000000771b0000 - 00000000772d1000: C:\WINDOWS\system32\ole32.dll
(0000000077340000 - 00000000773cb000: C:\WINDOWS\system32\COMCTL32.dll
(00000000773d0000 - 0000000077bc7000: C:\WINDOWS\system32\SHELL32.dll
(0000000077bd0000 - 0000000077bd7000: C:\WINDOWS\System32\midimap.dll
(0000000077be0000 - 0000000077bf4000: C:\WINDOWS\System32\MSACM32.dll
(0000000077c00000 - 0000000077c07000: C:\WINDOWS\system32\VERSION.dll
(0000000077c10000 - 0000000077c63000: C:\WINDOWS\system32\msvcrt.dll
(0000000077c70000 - 0000000077cb0000: C:\WINDOWS\system32\GDI32.dll
(0000000077d40000 - 0000000077dcc000: C:\WINDOWS\system32\USER32.dll
(0000000077dd0000 - 0000000077e5d000: C:\WINDOWS\system32\ADVAPI32.dll
(0000000077e60000 - 0000000077f46000: C:\WINDOWS\system32\kernel32.dll
(0000000077f50000 - 0000000077ff7000: C:\WINDOWS\System32\ntdll.dll
(0000000078000000 - 0000000078086000: C:\WINDOWS\system32\RPCRT4.dll
(000000007c340000 - 000000007c396000: C:\WINDOWS\System32\MSVCR71.DLL

*----> State Dump for Thread Id 0x8e4 <----*

eax=00000005 ebx=77d45b89 ecx=fffffffe edx=00000000 esi=0048af70 edi=0048af70
eip=7ffe0304 esp=0012da58 ebp=0012da7c iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000202

function: <nosymbols>
No prior disassembly possible
7ffe0304 c3 ret
7ffe0305 8bd4 mov edx,esp
7ffe0307 0f05 syscall
7ffe0309 c3 ret
7ffe030a 8ac8 mov cl,al
7ffe030c ff1570464d80 call dword ptr [804d4670]
7ffe0312 8b4510 mov eax,[ebp+0x10]
7ffe0315 33c9 xor ecx,ecx
7ffe0317 663908 cmp [eax],cx
7ffe031a 894dfc mov [ebp-0x4],ecx
7ffe031d 0f840d000000 je 7ffe0330
7ffe0323 0000 add [eax],al
7ffe0325 0000 add [eax],al
7ffe0327 0000 add [eax],al
7ffe0329 0000 add [eax],al
7ffe032b 0000 add [eax],al
7ffe032d 0000 add [eax],al
7ffe032f 0000 add [eax],al
7ffe0331 0000 add [eax],al
7ffe0333 0000 add [eax],al
7ffe0335 0000 add [eax],al
7ffe0337 0000 add [eax],al
7ffe0339 0000 add [eax],al
7ffe033b 0000 add [eax],al
7ffe0304 c3 ret
7ffe0305 8bd4 mov edx,esp
7ffe0307 0f05 syscall
7ffe0309 c3 ret
7ffe030a 8ac8 mov cl,al
7ffe030c ff1570464d80 call dword ptr [804d4670]
7ffe0312 8b4510 mov eax,[ebp+0x10]
7ffe0315 33c9 xor ecx,ecx
7ffe0317 663908 cmp [eax],cx
7ffe031a 894dfc mov [ebp-0x4],ecx
7ffe031d 0f840d000000 je 7ffe0330
7ffe0323 0000 add [eax],al
7ffe0325 0000 add [eax],al
7ffe0327 0000 add [eax],al
7ffe0329 0000 add [eax],al
7ffe032b 0000 add [eax],al
7ffe032d 0000 add [eax],al
7ffe032f 0000 add [eax],al
7ffe0331 0000 add [eax],al
7ffe0333 0000 add [eax],al
7ffe0335 0000 add [eax],al
7ffe0337 0000 add [eax],al
7ffe0339 0000 add [eax],al
7ffe033b 0000 add [eax],al
7ffe033d 0000 add [eax],al
7ffe033f 0000 add [eax],al

*----> Stack Back Trace <----*
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\USER32.dll -
*** WARNING: Unable to verify checksum for C:\Ventrilo\Ventrilo.exe
*** ERROR: Module load completed but symbols could not be loaded for C:\Ventrilo\Ventrilo.exe
WARNING: Stack unwind information not available. Following frames may be wrong.
ChildEBP RetAddr Args to Child
0012da54 77d43a21 77d443cd 0048af70 00000000 *SharedUserSystemCall+0xc (FPO: [0,0,0])
0012da7c 0045c15e 0048af70 00000000 00000000 USER32+0x3a21
0048af70 000003c0 00000000 001a9918 00108b69 Ventrilo+0x5c15e

*----> Raw Stack Dump <----*
000000000012da58 21 3a d4 77 cd 43 d4 77 - 70 af 48 00 00 00 00 00 !:.w.C.wp.H.....
000000000012da68 00 00 00 00 00 00 00 00 - 89 5b d4 77 70 af 48 00 .........[.wp.H.
000000000012da78 40 af 48 00 70 af 48 00 - 5e c1 45 00 70 af 48 00 @.H.p.H.^.E.p.H.
000000000012da88 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
000000000012da98 28 e1 12 00 52 a2 45 00 - 00 00 00 00 28 e1 12 00 (...R.E.....(...
000000000012daa8 f8 da 12 00 04 00 00 00 - 00 00 00 00 01 00 00 00 ................
000000000012dab8 00 00 00 00 00 00 00 00 - 4b 78 45 00 04 00 00 00 ........KxE.....
000000000012dac8 08 b0 48 00 40 af 48 00 - ff ff ff ff 00 00 00 00 ..H.@.H.........
000000000012dad8 00 00 00 00 28 e1 12 00 - 80 19 49 00 00 00 00 00 ....(.....I.....
000000000012dae8 c8 da 12 00 08 ff 12 00 - f8 9a 46 00 00 00 00 00 ..........F.....
000000000012daf8 c0 ff 12 00 63 a7 40 00 - 40 af 48 00 40 af 48 00 ....c.@.@.H.@.H.
000000000012db08 30 4c 99 00 30 4c 99 00 - 5c 56 65 6e 74 72 69 6c 0L..0L..\Ventril
000000000012db18 6f 5c 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 o\..............
000000000012db28 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
000000000012db38 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
000000000012db48 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
000000000012db58 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
000000000012db68 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
000000000012db78 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
000000000012db88 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................

*----> State Dump for Thread Id 0x8ec <----*

eax=0000c07d ebx=00007fc6 ecx=00007fc6 edx=00000000 esi=00dcff98 edi=00000001
eip=7ffe0304 esp=00dcff50 ebp=00dcff74 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000202

function: <nosymbols>
No prior disassembly possible
7ffe0304 c3 ret
7ffe0305 8bd4 mov edx,esp
7ffe0307 0f05 syscall
7ffe0309 c3 ret
7ffe030a 8ac8 mov cl,al
7ffe030c ff1570464d80 call dword ptr [804d4670]
7ffe0312 8b4510 mov eax,[ebp+0x10]
7ffe0315 33c9 xor ecx,ecx
7ffe0317 663908 cmp [eax],cx
7ffe031a 894dfc mov [ebp-0x4],ecx
7ffe031d 0f840d000000 je 7ffe0330
7ffe0323 0000 add [eax],al
7ffe0325 0000 add [eax],al
7ffe0327 0000 add [eax],al
7ffe0329 0000 add [eax],al
7ffe032b 0000 add [eax],al
7ffe032d 0000 add [eax],al
7ffe032f 0000 add [eax],al
7ffe0331 0000 add [eax],al
7ffe0333 0000 add [eax],al
7ffe0335 0000 add [eax],al
7ffe0337 0000 add [eax],al
7ffe0339 0000 add [eax],al
7ffe033b 0000 add [eax],al
7ffe0304 c3 ret
7ffe0305 8bd4 mov edx,esp
7ffe0307 0f05 syscall
7ffe0309 c3 ret
7ffe030a 8ac8 mov cl,al
7ffe030c ff1570464d80 call dword ptr [804d4670]
7ffe0312 8b4510 mov eax,[ebp+0x10]
7ffe0315 33c9 xor ecx,ecx
7ffe0317 663908 cmp [eax],cx
7ffe031a 894dfc mov [ebp-0x4],ecx
7ffe031d 0f840d000000 je 7ffe0330
7ffe0323 0000 add [eax],al
7ffe0325 0000 add [eax],al
7ffe0327 0000 add [eax],al
7ffe0329 0000 add [eax],al
7ffe032b 0000 add [eax],al
7ffe032d 0000 add [eax],al
7ffe032f 0000 add [eax],al
7ffe0331 0000 add [eax],al
7ffe0333 0000 add [eax],al
7ffe0335 0000 add [eax],al
7ffe0337 0000 add [eax],al
7ffe0339 0000 add [eax],al
7ffe033b 0000 add [eax],al
7ffe033d 0000 add [eax],al
7ffe033f 0000 add [eax],al

*----> Stack Back Trace <----*
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\System32\xfire_lsp_9425.dll -
WARNING: Stack unwind information not available. Following frames may be wrong.
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\kernel32.dll -
ChildEBP RetAddr Args to Child
00dcff4c 77d43a21 77d443cd 00dcff98 00000000 *SharedUserSystemCall+0xc (FPO: [0,0,0])
00dcff74 00b93d92 00dcff98 00000000 00000000 USER32+0x3a21
00dcffb4 77e7d33b 000007d0 00140808 00140000 xfire_lsp_9425+0x3d92
00dcffec 00000000 00b93d68 000007d0 00000000 kernel32!RegisterWaitForInputIdle+0x43

*----> Raw Stack Dump <----*
0000000000dcff50 21 3a d4 77 cd 43 d4 77 - 98 ff dc 00 00 00 00 00 !:.w.C.w........
0000000000dcff60 00 00 00 00 00 00 00 00 - c6 7f 00 00 01 00 00 00 ................
0000000000dcff70 00 00 00 00 b4 ff dc 00 - 92 3d b9 00 98 ff dc 00 .........=......
0000000000dcff80 00 00 00 00 00 00 00 00 - 00 00 00 00 08 08 14 00 ................
0000000000dcff90 00 00 14 00 d0 07 00 00 - 00 00 00 00 13 01 00 00 ................
0000000000dcffa0 c6 7f 00 00 37 3d b9 00 - 9e 8a 10 00 0a 02 00 00 ....7=..........
0000000000dcffb0 47 02 00 00 ec ff dc 00 - 3b d3 e7 77 d0 07 00 00 G.......;..w....
0000000000dcffc0 08 08 14 00 00 00 14 00 - d0 07 00 00 00 00 00 00 ................
0000000000dcffd0 00 c0 fd 7f c0 ff dc 00 - 07 00 00 00 ff ff ff ff ................
0000000000dcffe0 09 48 e9 77 b8 3d e8 77 - 00 00 00 00 00 00 00 00 .H.w.=.w........
0000000000dcfff0 00 00 00 00 68 3d b9 00 - d0 07 00 00 00 00 00 00 ....h=..........
0000000000dd0000 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000dd0010 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000dd0020 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000dd0030 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000dd0040 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000dd0050 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000dd0060 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000dd0070 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0000000000dd0080 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................

*----> State Dump for Thread Id 0x90c <----*

I have more log but thought this might be enough for you. Just let me know if it isn't

[Cactus]

Press Ctrl/Alt/Del and "End Task" or "End Process" on each of the following: (They may or may not be there)

mwsoemon.exe

Turn off System Restore. (Turn it back on after this is repaired and you've rebooted.) Close all other open Windows and have HiJackThis Fix:


O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\2.bin\MWSSRCAS.DLL
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe

O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe
O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\2.bin\MWSOEMON.EXE

O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\2.bin\MWSOEMON.EXE
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZN

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/fu ... .0.0.8.cab


Go to Control Panel / Add/Remove Programs and remove the
following if they are there:

MyWebSearch
My Search Bar
MyWay Speed Bar


Now delete these Folders or Files that are Highlighted: (You may need enable "Show all Files" and disable "Hide System Files" in Windows Explorer / Tools / Folder Options / View Tab) (You may have to boot to "Safe Mode" in order to delete some Files/Folders)

C:\Program Files\MyWebSearch\bar\2.bin\MWSOEMON.EXE


Now, empty all your TEMP Folders (WinXp has up to 4 of them) / Temporary Internet Files Folder and then empty your "Recycle Bin" and Reboot.

Turn on System restore,before opening your browser goto TOOLS>INTERNET OPTIONS and make sure your Homepage is correct,if not ,type the URL you would like in the HomePage box.

Now re-run HJT and post a new logfile back here.


Cactus

[QuietCowboy]

Ok thanks. I will do as you requested. Are you thinking that these might be part of the problem I am having?

[o0obrian0o0]

< loves hijackthis and would pay for it if i had to

[Cactus]