Staci's Hijackthis log

I tested my computer from last night to this morning..and I'm still getting the errors and freezes in regular mode. When I go into safe mode it runs just fine (although not having sound is annoying )

Click start > control panel > user accounts > change the way users log on or off > uncheck fast user switching > restart you computor.

Download, unzip and run 'RootkitRevealer' from Sysinternals:
http://www.sysinternals.com/Utilities/RootkitRevealer.html
Once the program has started, press Scan and let it run.
When the scan is done, use 'File > Save' to place the logfile in a convenient location (such as the desktop). The default filename will be 'RootkitReveal.txt'.

Save your Log File
Copy/Paste the contecnts of that logfile into your next reply

NOT touch the PC at ALL for Whatever reason/s until it has 100% completed its scan, or attempted scan in case of some error etc !

That way you should have a much simpler and clearer log file in which to peruse and evaluate.

Ok…fast user switching is already unchecked. When I reboot, do I need to run in regular mode or safe mode before running RootkitRevealer?

regular mode

Here is the log I didn't touch anything until it was done hehe. I had a problem saving it though, it was giving me some errors at first trying to save on desktop, I had to look around until it let me get into My Documents to save. HKLM\SYSTEM\ControlSet001\Services\sysbus32 2/20/2006 12:00 PM 0 bytes Hidden from Windows API. HKLM\SYSTEM\ControlSet003\Services\sysbus32 2/20/2006 12:00 PM 0 bytes Hidden from Windows API. C:\Documents and Settings\Guest\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys 12/6/2005 8:03 AM 0 bytes Hidden from Windows API. C:\Documents and Settings\Guest\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#cartoonnetwork.com 11/3/2005 7:24 PM 0 bytes Hidden from Windows API. C:\Documents and Settings\Guest\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#cartoonnetwork.com\settings.sol 11/3/2005 7:24 PM 88 bytes Hidden from Windows API. C:\Documents and Settings\Guest\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.nick.com 12/6/2005 8:03 AM 0 bytes Hidden from Windows API. C:\Documents and Settings\Guest\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.nick.com\settings.sol 12/6/2005 8:03 AM 82 bytes Hidden from Windows API. C:\Documents and Settings\Guest\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol 12/6/2005 8:03 AM 400 bytes Hidden from Windows API. C:\Documents and Settings\Kids\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys 2/12/2006 10:44 AM 0 bytes Hidden from Windows API. C:\Documents and Settings\Kids\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol 2/12/2006 10:44 AM 348 bytes Hidden from Windows API. C:\Documents and Settings\Stacy\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys 2/9/2006 11:46 AM 0 bytes Hidden from Windows API. C:\Documents and Settings\Stacy\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#aolcdn.com 2/2/2006 5:33 AM 0 bytes Hidden from Windows API. C:\Documents and Settings\Stacy\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#aolcdn.com\settings.sol 2/2/2006 5:33 AM 80 bytes Hidden from Windows API. C:\Documents and Settings\Stacy\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#battleon.com 2/3/2006 11:23 PM 0 bytes Hidden from Windows API. C:\Documents and Settings\Stacy\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#battleon.com\settings.sol 2/3/2006 11:23 PM 82 bytes Hidden from Windows API. C:\Documents and Settings\Stacy\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#carlsjr.com 12/7/2005 10:13 PM 0 bytes Hidden from Windows API. C:\Documents and Settings\Stacy\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#carlsjr.com\settings.sol 12/7/2005 10:13 PM 81 bytes Hidden from Windows API. C:\Documents and Settings\Stacy\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#everquest2.station.sony.com 11/25/2005 11:32 PM 0 bytes Hidden from Windows API. C:\Documents and Settings\Stacy\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#everquest2.station.sony.com\settings.sol 11/25/2005 11:32 PM 97 bytes Hidden from Windows API. C:\Documents and Settings\Stacy\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#hquass.de 1/28/2006 6:51 AM 0 bytes Hidden from Windows API. C:\Documents and Settings\Stacy\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#hquass.de\settings.sol 1/28/2006 6:51 AM 79 bytes Hidden from Windows API. C:\Documents and Settings\Stacy\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iprom.net 2/9/2006 11:46 AM 0 bytes Hidden from Windows API. C:\Documents and Settings\Stacy\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iprom.net\settings.sol 2/9/2006 11:46 AM 79 bytes Hidden from Windows API. C:\Documents and Settings\Stacy\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#local 1/17/2006 3:28 AM 0 bytes Hidden from Windows API. C:\Documents and Settings\Stacy\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#local\settings.sol 1/17/2006 3:28 AM 75 bytes Hidden from Windows API. C:\Documents and Settings\Stacy\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#mediaiprom.com 2/9/2006 11:46 AM 0 bytes Hidden from Windows API. C:\Documents and Settings\Stacy\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#mediaiprom.com\settings.sol 2/9/2006 11:46 AM 84 bytes Hidden from Windows API. C:\Documents and Settings\Stacy\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#rr.com 10/28/2005 11:11 PM 0 bytes Hidden from Windows API. C:\Documents and Settings\Stacy\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#rr.com\settings.sol 10/28/2005 11:11 PM 76 bytes Hidden from Windows API. C:\Documents and Settings\Stacy\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#starwarsgalaxies.station.sony.com 11/27/2005 9:38 PM 0 bytes Hidden from Windows API. C:\Documents and Settings\Stacy\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#starwarsgalaxies.station.sony.com\settings.sol 11/27/2005 9:38 PM 103 bytes Hidden from Windows API. C:\Documents and Settings\Stacy\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#ugo.com 11/26/2005 1:35 PM 0 bytes Hidden from Windows API. C:\Documents and Settings\Stacy\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#ugo.com\settings.sol 11/26/2005 1:35 PM 77 bytes Hidden from Windows API. C:\Documents and Settings\Stacy\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#video.google.com 1/8/2006 5:39 PM 0 bytes Hidden from Windows API. C:\Documents and Settings\Stacy\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#video.google.com\settings.sol 1/8/2006 5:39 PM 86 bytes Hidden from Windows API. C:\Documents and Settings\Stacy\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#warnerbros.com 11/21/2005 6:58 PM 0 bytes Hidden from Windows API. C:\Documents and Settings\Stacy\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#warnerbros.com\settings.sol 11/21/2005 6:58 PM 84 bytes Hidden from Windows API. C:\Documents and Settings\Stacy\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.nick.com 12/4/2005 11:49 AM 0 bytes Hidden from Windows API. C:\Documents and Settings\Stacy\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.nick.com\settings.sol 12/4/2005 11:49 AM 82 bytes Hidden from Windows API. C:\Documents and Settings\Stacy\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.purevolume.com 1/14/2006 7:06 AM 0 bytes Hidden from Windows API. C:\Documents and Settings\Stacy\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.purevolume.com\settings.sol 1/14/2006 7:06 AM 88 bytes Hidden from Windows API. C:\Documents and Settings\Stacy\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol 2/9/2006 11:46 AM 625 bytes Hidden from Windows API.

Looks clean

Hmmm… In the past two hours of running in regular mode, I've had about 6 errors pop up and the taskbar has disappeared and come back 3 times. However, it hasn't frozen completely and required a reboot yet. Also, it's loading a lot faster when I first log in. It only takes about 5-10 seconds and then the hourglass disappears and an arrow comes up. About 5-10 seconds later it will let me click on the Quick Launch and Start button. Running in safe mode this morning I had no errors or problems at all, and it loaded the screen right away and let me click on the QL and SB immediately. Do I still need to run the sfc /scannow? I haven't done that yet since I didn't have the WinXP CD hehe

Do I still need to run the sfc /scannow? I haven't done that yet since I didn't have the WinXP CD

Yes when you can find it.

Looking for a tool I would like you to run but I have to find the linke going off line for a day.
I'll post soon.

My brother-in-law is apparently using Linux now (according to my sister). Hopefully he still has the WinXP cd If not I'll try around and see if I can find it elsewhere. Is it ok if I post the logs from my mom's computer too? (She uses her own downstairs from mine). I can post them in a different post if I need to. Hers is running fairly well since I ran all the different anti-spywares and such on hers…but I'd like to have someone check it over and help me get it set up so it will be safe too if that's possible Thank you so much for all your help Little Eagle. It's still having problems but at least it's somewhat useable now. I really appreciate all the time you've taken to help me

Download AproposFix by Swandog46
Save it to your desktop or to another folder of its own, but do NOT run it yet!

Now reboot your computer in Safe Mode! (You must be in safe mode or this fix will not work.)

Once in Safe Mode, double-click aproposfix.exe which will give you a chice of where to unzip/install the program to). This is called the Destination folder in the window that popsup. So either install it to the Desktop or the folder where you downloaded the aproposfix.exe file to. It will create a new folder named aproposfix. Open the aproposfix folder and double click on RunThis.bat to run the fix. Follow the prompts.

When the tool is finished, reboot back into normal mode, and post a new HijackThis log, along with the entire contents of the log.txt file that has been created in the aproposfix folder.

Is it ok if I post the logs from my mom's computer too?

Yes but start another thread. Makes it easier

Run cleanup and then defragment your PC.

Ok did both and computer seems to be running faster now. It really needed to be defragmented, and the cleanup got rid of about 300MB of junk I think I trakced down a WinXP CD I can use..so once I do that and use the repair function, I will let you know how it's running..unless there's anything else you need me to do in the meantime. Errors still happening in regular mode too.

What are the errors that you are getting?