System Scan virus -- says harddrive, ram failed [Solved]

OK, I will do all of this later today. I have to run out of the office for a couple of hours. I can see ComboFix on my desktop whilre logged in as Administrator in Safe Mode with Networking. Will this procedure you outlined work in Safe Mode with Netowrking?

I can see ComboFix on my desktop whilre logged in as Administrator in Safe Mode with Networking. Will this procedure you outlined work in Safe Mode with Netowrking?

Yes, so that's good news.

When you have time, follow the procedures in the previous post and then please send a new ComboFi log..

OK, I did everything except the ComboFix. Do you want me to just go back to the last instruction for ComboFix a day or so ago?

OK, I did everything except the ComboFix. Do you want me to just go back to the last instruction for ComboFix a day or so ago?

Do you want me to just go back to the last instruction for ComboFix a day or so ago?

No, just produce a new ComboFix log and let me know if there are any changes.

Satchfan

Wait. i'm supposed to run ComboFix, right? I just tried to run it, and it told me that it had expired. It asked me if i wanted it to run in reduced mode or something like that. I said no and exited. Do I need to delete the one on my desktop and re-download it?

I don't understand why you got that message because your version of ComboFix was not old enough to warrent that prompt. However, yes - please do as you say: delete the other version and download a new one. Thanks

Something hinky is definitely going on, because the first time I tried to run ComboFix it told me Avira was active, which I had checked before I ran it to make sure it was disabled. Then I tried to quit ComboFix so i could re-log on in normal mode so i could disable it again (I can't to from Safe Networking mode!). ComboFix had started to run but I quickly closed all the boxes and restarted in normal mode. Avira was not active. So I rebooted again into Safe Netowrking to run Combofix again, it ran fine, didn't say anything about Avira. But then it gave me that message about being expired. OK, I'm going to delete it and re-download it now.

I just restarted and let the computer boot up in normal mode, and I think I have noticed some differences. First of all, Internet Explorer is now in the Start/Programs. All of my "favorites" are there in IE, including the shortcut to this form, which I created in Safe Networking as Administrator. Also, Malwarebytes is in the program list and the links to the program appear. Finally, Google Chrome is in the program list, with what look like valid links. The desktop is still black, though. Wait! I was just going to report to you that the taskbar at the bottom right of the screen was the same and that Avira was enabled again even though I didn't re-enable it, but I right-clicked just to the left of the icons and the word "Desktop" appared! II clicked on the arrows next to the word "Desktop" and all of the desktop icons are there! I screwed around in Desktop trying to make it appear on the actual desktop, but no joy. I was able to change my start menu back to the Windows start menu where My Documents, My Pictures, My Computer appear (and they work)! HijackThis also appears in the start menu. However, the start/programs menu still does not include any of the programs other than what I've reported above. Amazing progress!

Hi Shannon

Some progress but let’s try and find out why your desktop remains stubborn .

In normal mode, try opening explorer.exe using the Task Manager and see if that makes a difference:

Open Task Manager • clickFile
• click New Task(Run…)
• copy and paste the following line into the “open:” field
explorer.exe
• click OK
Let me know what happens.

====================================

Re-un SystemLook

Please run SystemLook in “normal” mode, download it again and save it save it in your user folder,(as you can’t see it if you save it to the desktop}.

• Download it from one of these locations:
  Download Mirror #1
  Download Mirror #2
  
• double-click SystemLook.exe to run it.
• copy the content of the following codebox into the main textfield, (this time, be sure to include the colon (:) before the word reg):
  
  

  :reg 
  HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell /s
  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserShellFolder
  HKEY_CURRENT_USER\Control Panel\Desktop /s

  
  
• click the Look button to start the scan.
• when finished, a notepad window will open with the results of the scan. Please copy and paste the contents in your next reply.

Note: If you have closed the notepad file, the log can be found in the same location as you saved SysyemLook.

Satchfan

When I ran exeplorer.exe from the task manager, it opened up My Documents. I was able to save SystemLook to the desktop and access it from the list on the bottom tool bar. All of the applications I previously saved to the desktop but couldn't see are there. Here is the SystemLook log: SystemLook 30.07.11 by jpshortstuff Log created at 21:10 on 29/03/2012 by Shannon Administrator - Elevation successful ========== reg ========== [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell] (Unable to open key - key not found) [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDriveTypeAutoRun"= 0x0000000091 (145) "NoFolderOptions"= 0x0000000000 (0) "NoDesktop"= 0x0000000001 (1) [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserShellFolder] (Unable to open key - key not found) [HKEY_CURRENT_USER\Control Panel\Desktop] "ActiveWndTrkTimeout"= 0x0000000000 (0) "AutoEndTasks"="0" "CaretWidth"= 0x0000000001 (1) "CoolSwitch"="1" "CoolSwitchColumns"="7" "CoolSwitchRows"="3" "CursorBlinkRate"="530" "DragFullWindows"="0" "DragHeight"="4" "DragWidth"="4" "FontSmoothing"="0" "FontSmoothingOrientation"= 0x0000000001 (1) "FontSmoothingType"= 0x0000000001 (1) "ForegroundFlashCount"= 0x0000000003 (3) "ForegroundLockTimeout"= 0x0000030d40 (200000) "GridGranularity"="0" "HungAppTimeout"="5000" "LowPowerActive"="0" "LowPowerTimeOut"="0" "MenuShowDelay"="400" "PaintDesktopVersion"= 0x0000000000 (0) "PowerOffActive"="0" "PowerOffTimeOut"="0" "ScreenSaverIsSecure"="0" "ScreenSaveTimeOut"="360" "ScreenSaveActive"="1" "SCRNSAVE.EXE"="C:\WINDOWS\system32\logon.scr" "TileWallpaper"="0" "UserPreferencesMask"=90 12 01 80 (REG_BINARY) "WaitToKillAppTimeout"="20000" "WallpaperStyle"="2" "OriginalWallpaper"="C:\Documents and Settings\Shannon\Local Settings\Application Data\Microsoft\Wallpaper1.bmp" "WheelScrollLines"="3" "Pattern Upgrade"="TRUE" "ConvertedWallpaper"="C:\WINDOWS\Web\Wallpaper\Purple flower.jpg" "ConvertedWallpaper Last WriteTime"=00 a0 a1 10 27 9e c8 01 (REG_BINARY) "_Wallpaper"="C:\Documents and Settings\Shannon\Local Settings\Application Data\Microsoft\Wallpaper1.bmp" "Wallpaper"="" "WallpaperOld"="C:\Documents and Settings\Shannon\Application Data\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp" "WallpaperStyleOld"="2" "TileWallpaperOld"="0" [HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics] "BorderWidth"="-15" "CaptionFont"=f5 ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 bc 02 00 00 00 00 00 01 00 00 00 00 54 00 61 00 68 00 6f 00 6d 00 61 00 00 00 65 00 74 00 20 00 4d 00 53 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 (REG_BINARY) "CaptionHeight"="-285" "CaptionWidth"="-270" "IconFont"=f5 ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 90 01 00 00 00 00 00 01 00 00 00 00 54 00 61 00 68 00 6f 00 6d 00 61 00 00 00 ff ff fa cf 90 7c 2b 9c 80 7c e8 02 00 00 8c b3 07 00 4c 00 00 00 8b 00 00 00 8b 00 00 00 01 00 00 00 f5 ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 (REG_BINARY) "IconSpacing"="-1125" "IconTitleWrap"="1" "IconVerticalspacing"="-1125" "MenuFont"=f5 ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 90 01 00 00 00 00 00 01 00 00 00 00 54 00 61 00 68 00 6f 00 6d 00 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 (REG_BINARY) "MenuHeight"="-285" "MenuWidth"="-270" "MessageFont"=f5 ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 90 01 00 00 00 00 00 01 00 00 00 00 54 00 61 00 68 00 6f 00 6d 00 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 (REG_BINARY) "ScrollHeight"="-240" "ScrollWidth"="-240" "Shell Icon BPP"="16" "SmCaptionFont"=f5 ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 bc 02 00 00 00 00 00 01 00 00 00 00 54 00 61 00 68 00 6f 00 6d 00 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 (REG_BINARY) "SmCaptionHeight"="-285" "SmCaptionWidth"="-180" "StatusFont"=f5 ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 90 01 00 00 00 00 00 01 00 00 00 00 54 00 61 00 68 00 6f 00 6d 00 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 (REG_BINARY) "AppliedDPI"= 0x0000000060 (96) "Shell Icon Size"="32" "MinAnimate"="0" -= EOF =-

Hi Satchfan, Apparently Avira has been running a scheduled scan even though I have repeatedly disabled it. I was just watchingTV when I heard this computer make a beep sound. I checked the event log on Avira and found that it detected a virus on March 16, March 22 and just now. Also, the event log shows that until today, the automatic updates have been successful. Here is the log of the scan on March 22: Avira AntiVir Personal Report file date: Thursday, March 22, 2012 17:06 Scanning for 3584594 virus strains and unwanted programs. The program is running as an unrestricted full version. Online services are available: Licensee : Avira AntiVir Personal - Free Antivirus Serial number : 0000149996-ADJIE-0000001 Platform : Windows XP Windows version : (Service Pack 3) [5.1.2600] Boot mode : Normally booted Username : SYSTEM Computer name : ACER-330BB84976 Version information: BUILD.DAT : 10.2.0.707 36070 Bytes 1/25/2012 13:11:00 AVSCAN.EXE : 10.3.0.7 484008 Bytes 7/2/2011 18:13:52 AVSCAN.DLL : 10.0.5.0 47464 Bytes 7/2/2011 18:13:52 LUKE.DLL : 10.3.0.5 45416 Bytes 7/2/2011 18:13:53 LUKERES.DLL : 10.0.0.1 12648 Bytes 2/11/2010 06:40:49 AVSCPLR.DLL : 10.3.0.7 119656 Bytes 7/2/2011 18:13:54 AVREG.DLL : 10.3.0.9 88833 Bytes 7/13/2011 02:25:18 VBASE000.VDF : 7.10.0.0 19875328 Bytes 11/6/2009 16:05:36 VBASE001.VDF : 7.11.0.0 13342208 Bytes 12/14/2010 21:23:50 VBASE002.VDF : 7.11.19.170 14374912 Bytes 12/20/2011 03:40:43 VBASE003.VDF : 7.11.21.238 4472832 Bytes 2/1/2012 02:26:53 VBASE004.VDF : 7.11.21.239 2048 Bytes 2/1/2012 02:26:53 VBASE005.VDF : 7.11.21.240 2048 Bytes 2/1/2012 02:26:53 VBASE006.VDF : 7.11.21.241 2048 Bytes 2/1/2012 02:26:53 VBASE007.VDF : 7.11.21.242 2048 Bytes 2/1/2012 02:26:54 VBASE008.VDF : 7.11.21.243 2048 Bytes 2/1/2012 02:26:54 VBASE009.VDF : 7.11.21.244 2048 Bytes 2/1/2012 02:26:54 VBASE010.VDF : 7.11.21.245 2048 Bytes 2/1/2012 02:26:54 VBASE011.VDF : 7.11.21.246 2048 Bytes 2/1/2012 02:26:54 VBASE012.VDF : 7.11.21.247 2048 Bytes 2/1/2012 02:26:55 VBASE013.VDF : 7.11.22.33 1486848 Bytes 2/3/2012 02:27:13 VBASE014.VDF : 7.11.22.56 687616 Bytes 2/3/2012 02:27:21 VBASE015.VDF : 7.11.22.92 178176 Bytes 2/6/2012 02:27:23 VBASE016.VDF : 7.11.22.154 144896 Bytes 2/8/2012 02:27:25 VBASE017.VDF : 7.11.22.220 183296 Bytes 2/13/2012 04:50:09 VBASE018.VDF : 7.11.23.34 202752 Bytes 2/15/2012 01:16:12 VBASE019.VDF : 7.11.23.98 126464 Bytes 2/17/2012 01:16:13 VBASE020.VDF : 7.11.23.150 148480 Bytes 2/20/2012 01:16:15 VBASE021.VDF : 7.11.23.224 172544 Bytes 2/23/2012 03:37:02 VBASE022.VDF : 7.11.24.52 219648 Bytes 2/28/2012 02:50:29 VBASE023.VDF : 7.11.24.152 165888 Bytes 3/5/2012 00:22:26 VBASE024.VDF : 7.11.24.204 177664 Bytes 3/7/2012 02:13:18 VBASE025.VDF : 7.11.25.30 245248 Bytes 3/12/2012 01:05:03 VBASE026.VDF : 7.11.25.121 252416 Bytes 3/15/2012 23:04:14 VBASE027.VDF : 7.11.25.177 202752 Bytes 3/20/2012 04:03:19 VBASE028.VDF : 7.11.25.178 2048 Bytes 3/20/2012 04:03:19 VBASE029.VDF : 7.11.25.179 2048 Bytes 3/20/2012 04:03:20 VBASE030.VDF : 7.11.25.180 2048 Bytes 3/20/2012 04:03:20 VBASE031.VDF : 7.11.25.206 95744 Bytes 3/21/2012 04:03:21 Engineversion : 8.2.10.24 AEVDF.DLL : 8.1.2.2 106868 Bytes 11/1/2011 02:42:07 AESCRIPT.DLL : 8.1.4.10 455035 Bytes 3/15/2012 23:04:43 AESCN.DLL : 8.1.8.2 131444 Bytes 1/28/2012 03:26:12 AESBX.DLL : 8.2.5.5 606579 Bytes 3/13/2012 01:05:36 AERDL.DLL : 8.1.9.15 639348 Bytes 9/8/2011 23:02:07 AEPACK.DLL : 8.2.16.5 803190 Bytes 3/8/2012 02:13:54 AEOFFICE.DLL : 8.1.2.25 201084 Bytes 1/7/2012 18:36:54 AEHEUR.DLL : 8.1.4.7 4501878 Bytes 3/17/2012 03:42:59 AEHELP.DLL : 8.1.19.0 254327 Bytes 1/21/2012 22:09:24 AEGEN.DLL : 8.1.5.23 409973 Bytes 3/8/2012 02:13:24 AEEXP.DLL : 8.1.0.25 74101 Bytes 3/15/2012 23:04:44 AEEMU.DLL : 8.1.3.0 393589 Bytes 1/10/2011 21:23:18 AECORE.DLL : 8.1.25.6 201078 Bytes 3/15/2012 23:04:17 AEBB.DLL : 8.1.1.0 53618 Bytes 1/10/2011 21:23:18 AVWINLL.DLL : 10.0.0.0 19304 Bytes 1/10/2011 21:23:32 AVPREF.DLL : 10.0.3.2 44904 Bytes 7/2/2011 18:13:52 AVREP.DLL : 10.0.0.10 174120 Bytes 5/19/2011 22:29:40 AVARKT.DLL : 10.0.26.1 255336 Bytes 7/2/2011 18:13:52 AVEVTLOG.DLL : 10.0.0.9 203112 Bytes 7/2/2011 18:13:52 SQLITE3.DLL : 3.6.19.0 355688 Bytes 6/17/2010 21:27:22 AVSMTP.DLL : 10.0.0.17 63848 Bytes 1/10/2011 21:23:31 NETNT.DLL : 10.0.0.0 11624 Bytes 6/17/2010 21:27:21 RCIMAGE.DLL : 10.0.0.35 2589544 Bytes 7/2/2011 18:13:50 RCTEXT.DLL : 10.0.64.0 97640 Bytes 7/2/2011 18:13:50 Configuration settings for the scan: Jobname………………………..: avguard_async_scan Configuration file………………: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\AVGUARD_4fa81a85\guard_slideup.avp Logging………………………..: Default Primary action………………….: repair Secondary action………………..: quarantine Scan master boot sector………….: on Scan boot sector………………..: off Process scan……………………: on Scan registry…………………..: off Search for rootkits……………..: on Integrity checking of system files..: off Scan all files………………….: All files Scan archives…………………..: on Recursion depth…………………: 20 Smart extensions………………..: on Macro heuristic…………………: on File heuristic………………….: Complete Deviating risk categories………..: +APPL,+GAME,+JOKE,+PCK,+PFS,+SPR, Start of the scan: Thursday, March 22, 2012 17:06 Starting search for hidden objects. The scan of running processes will be started Scan process 'rsmsink.exe' - '1' Module(s) have been scanned Scan process 'msdtc.exe' - '1' Module(s) have been scanned Scan process 'dllhost.exe' - '1' Module(s) have been scanned Scan process 'dllhost.exe' - '1' Module(s) have been scanned Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'wuauclt.exe' - '1' Module(s) have been scanned Scan process 'alg.exe' - '1' Module(s) have been scanned Scan process 'iPodService.exe' - '1' Module(s) have been scanned Scan process 'WLIDSvcM.exe' - '1' Module(s) have been scanned Scan process 'WLIDSVC.EXE' - '1' Module(s) have been scanned Scan process 'vssvc.exe' - '1' Module(s) have been scanned Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'SeaPort.exe' - '1' Module(s) have been scanned Scan process 'HPZipm12.exe' - '1' Module(s) have been scanned Scan process 'avshadow.exe' - '1' Module(s) have been scanned Scan process 'GoogleUpdate.exe' - '1' Module(s) have been scanned Scan process 'SMSvcHost.exe' - '1' Module(s) have been scanned Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned Scan process 'ctfmon.exe' - '1' Module(s) have been scanned Scan process 'iTunesHelper.exe' - '1' Module(s) have been scanned Scan process 'avgnt.exe' - '1' Module(s) have been scanned Scan process 'IAANTMon.exe' - '1' Module(s) have been scanned Scan process 'SynTPEnh.exe' - '1' Module(s) have been scanned Scan process 'cisvc.exe' - '1' Module(s) have been scanned Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned Scan process 'avguard.exe' - '1' Module(s) have been scanned Scan process 'netdde.exe' - '1' Module(s) have been scanned Scan process 'Explorer.EXE' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'sched.exe' - '1' Module(s) have been scanned Scan process 'spoolsv.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned Starting the file scan: Begin scan in 'C:\System Volume Information\_restore{D943BACC-C405-4AD7-B9AF-994E097D0C0F}\RP360\A0064283.exe' C:\System Volume Information\_restore{D943BACC-C405-4AD7-B9AF-994E097D0C0F}\RP360\A0064283.exe [DETECTION] Is the TR/Offend.kdv.571726 Trojan [NOTE] The file was moved to the quarantine directory under the name '4d581e53.qua'. End of the scan: Thursday, March 22, 2012 17:08 Used time: 01:55 Minute(s) The scan has been done completely. 0 Scanned directories 44 Files were scanned 1 Viruses and/or unwanted programs were found 0 Files were classified as suspicious 0 files were deleted 0 Viruses and unwanted programs were repaired 1 Files were moved to quarantine 0 Files were renamed 0 Files cannot be scanned 43 Files not concerned 0 Archives were scanned 0 Warnings 1 Notes 44545 Objects were scanned with rootkit scan 0 Hidden objects were found

It appears that a registry fix that we did earlier has changed again so we’ll fix it again and see what happens.

Again, run these as Shannon.

Launch Notepad (Start>All Programs>Accessories), and copy/paste all the Quoted REGEDIT below to it. Don't forget to include REGEDIT4.

• Save in: Desktop
• File Name: fixme.reg
• Save as Type: All files
• Click: Save

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoDesktop"=dword:00000000
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop
"NoChangingWallPaper" =dword:00000000

On the desktop, doubleclick fixme.reg and allow it to run. Let it merge

Reboot

====================================

Re-un SystemLook

Please run SystemLook in “normal” mode.

• double-click SystemLook.exe to run it.
• copy the content of the following codebox into the main textfield, (this time, be sure to include the colon (:) before the word reg):
  

  :reg 
  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop
  HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies /s 
  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer /s

• click the Look button to start the scan.
• when finished, a notepad window will open with the results of the scan. Please copy and paste the contents in your next reply.

Note: If you have closed the notepad file, the log can be found in the same location as you saved SysyemLook.

Any changes to the desktop? Try changing the wallpaper and let me know what happens.

Also, try right-clicking on eg OTL in your taskbar and see if you can “Unpin it”. If that doesn’t work, try dragging it onto the desktop and see if that works.

Please update me on the current situation in normal,(Shannon), mode.

Thanks

Satchfan

Woo hoo! After the reg fix, the desktop icons are back on the desktop! Still no programs in the start menu. I tried to post the SystemLook log along with this reply but got an error saying it was too long. So i'll send this reply now and will send the log in the next reply.