I have turned off all error reporting services, but this dumprep thing simply wouldn't go away no matter how many times I delete it from my msconfig startup or registery. It just reappear itself everytime I reboot.
What is wrong?
Here is my log: Logfile of HijackThis v1.99.1
Scan saved at 1:06:31 AM, on 11/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Description: Used in connection with memory dumps - you can disable these by - right clicking on My Computer, selecting Properties and then the Advanced tab. Click on the Settings button in 'Startup and Recovery'. In the bottom pane - under 'Write debugging informatio
Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
Close ALL windows and browsers except HijackThis and click "Fix checked"
Reboot and "copy/paste" a new HijackThis log file into this thread.
Also please describe how your computer behaves at the moment.
Thanks! Here is the new log after I followed your instruction.
Looks like the O2 is gone but the 04 dumprep is still here.
Logfile of HijackThis v1.99.1
Scan saved at 9:47:47 AM, on 11/15/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
Close ALL windows and browsers except HijackThis and click "Fix checked"
Reboot and "copy/paste" a new HijackThis log file into this thread.
Also please describe how your computer behaves at the moment.
New log: Logfile of HijackThis v1.99.1
Scan saved at 4:28:18 PM, on 11/15/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
My computer seems fine. Can't really find anything wrong except it took very long to download all the windows XP updates. And there is always a Dr.Watson error message box pop up when I shut down my computer. But the shut down process is so fast that I never able to click anything on the message box.
Download Accelerator Plus from Speedbit. Download manager for resuming downloads, amongst other features. Available via Start -> Programs. Note that the free version is "adware" based
Download Accelerator Plus from Speedbit. Download manager for resuming downloads, amongst other features. Available via Start -> Programs. Note that the free version is "adware" based
Yes, it a free version. But I used my router firewall option to block the ip address from where the DAP get it's ad banner from.
1) Open Hijackthis.
Click the "Open the Misc Tools" section Button.
Click the "Open Uninstall Manager" Button.
Click the "Save list…" Button.
Save it to your desktop. Copy and paste the contents into your reply.
1) Open Hijackthis.
Click the "Open the Misc Tools" section Button.
Click the "Open Uninstall Manager" Button.
Click the "Save list…" Button.
Save it to your desktop. Copy and paste the contents into your reply.
3D Bungalow Aquarium Screensaver 1.1
3D Canyon Flight Screensaver (remove only)
3D Living Waterfall Screensaver 1.0
3D World Map 2.0
3Planesoft Screensaver Manager 1.0
Adobe Bridge 1.0
Adobe Common File Installer
Adobe Download Manager 1.2 (Remove Only)
Adobe Help Center 1.0
Adobe Photoshop CS2
Adobe Reader 7.0
Adobe Reader Chinese Traditional Fonts
Adobe Reader Japanese Fonts
Adobe Stock Photos 1.0
Air Traffic Control
Alcohol 120%
Ancient Castle 3D Screensaver 1.1
ASUS Probe V2.21.07
ATI - Software Uninstall Utility
ATI Control Panel
ATI Display Driver
ATI HydraVision
AWC 3.0
BitComet 0.70
BJC-2000
Butterfly Garden Screensaver
Canon PIXMA iP1500
Canon Utilities Easy-PhotoPrint
ccCommon
CCleaner (remove only)
Christmas 3D Screensaver 1.0
Christmas PhotoAlbum ScreenSaver
Christmas Tree Screensaver
Codec Pack - All In 1 [removed]
Color Flatbed Scanner
Creative DVD Audio Plugin for Audigy Series
Deutz Engine
Discovery 3D Screensaver 1.1
DivX Codec
DivX Content Uploader
DivX Converter
DivX Player
DivX Web Player
Download Accelerator Plus Beta
Dream Aquarium
Earth 3D Space Tour screensaver v1.1
EasyGPRS
EasyLink
Easy-WebPrint
F1 Racing 3D Screensaver v1.0
Fantasy Moon 3D Screensaver 1.3
ffdshow
Fireplace 3D Screensaver 1.0
Flight Simulator Screensaver 0.9
FontLister 3.4.9
Galaxy 3D Space Tour screensaver v1.0
GizmoZone.com WaterWorld - Deep Sea Screensaver
GlobFX Space Travel
Google Talk (remove only)
Google Toolbar for Internet Explorer
HijackThis 1.99.1
Hot Wings Screensaver
ICQ
Inside the Cell 3D Screensaver 1.1
Internet Worm Protection
InterVideo WinDVD 5
IsoBuster 1.8
J2SE Runtime Environment 5.0 Update 6
Java 2 Runtime Environment, SE v1.4.2_05
KhalSetup
Lantern 3D Screensaver 1.0
LifeGlobe Goldfish Aquarium
LiveUpdate 3.0 (Symantec Corporation)
Logitech MouseWare 9.79.1
Logitech SetPoint
Logitech® Camera AX°Eμ{|!
Macromedia Dreamweaver 4
Macromedia Extension Manager
Macromedia Flash Player 8
Macromedia Shockwave Player
Mars 3D Space Tour screensaver v1.1
Mars Screensaver 1.0
Maya Paint Effects Screen Saver
Mechanical Clock 3D Screensaver 1.0
Microsoft Data Access Components KB870669
Microsoft Office 2000 Premium
Microsoft User-Mode Driver Framework Feature Pack 1.0.0 (Pre-Release 5348)
Microsoft Visual C++ 2005 Redistributable
MJ 6.1
Moon 3D Space Tour screensaver v1.1
Mozilla Firefox (2.0)
mx5_screensaver
Nature 3D Screensaver 1.1
NAVShortcut
Neat Image v5 Demo (with plug-in)
Nero Burning Rom Screensaver
Nero Suite
Norton AntiVirus 2006
Norton AntiVirus 2006 (Symantec Corporation)
Norton AntiVirus Help
Norton AntiVirus Parent MSI
Norton AntiVirus SYMLT MSI
Norton Protection Center
Norton WMI Update
PeerGuardian 2.0
PenPowerJR-5.0
PowerDVD
PPStream
QuickTime
Radar Screensaver version 1.60
Real Alternative 1.50
Real SnowGlobes 3D
RealPlayer
RichWin97
RX8 Screen Saver
Saturn 3D Space Tour screensaver v1.0
Screen Saver Control
Seascape 3D Screensaver 1.1
SeaStorm 3D Screensaver (remove only)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB922760)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924270)
SereneScreen Marine Aquarium Time
SharkPort 2
SoundMAX
Space Exploration 3D Screensaver 1.2
Space Trip 3D Screensaver 1.3
SPBBC
Spirit of Fire 3D Screensaver 2.2
Spybot - Search & Destroy 1.4
Symantec
TeamSpeak 2 RC2
TGZ CO-OP Map Pack 1
TGZ CO-OP Map Pack 2
TGZ CO-OP Map Pack 4
TGZ CO-OP Map Pack 6
The Lost Watch 3D Screensaver 1.0
The Matrix Reloaded 3D Screensaver v2.0
The One Ring 3D Screensaver 1.0
The Pyramids Of Egypt 3D (remove only)
Tom Clancy's Rainbow Six 3: Athena Sword 1.10.016
Tom Clancy's Rainbow Six 3: Iron Wrath 1.00.000
Tom Clancy's Rainbow Six 3: Raven Shield 1.60.412
Tropical Bungalow 3D Screensaver 1.0
Tweak UI
ubi.com
Universe Screensaver
USB Data Cable
User Profile Hive Cleanup Service
VideoLAN VLC media player 0.8.5
Voyage of Columbus 3D Screensaver 1.0
Watermill 3D Screensaver 1.0
Winamp (remove only)
Windows Defender
Windows Defender Signatures
Windows Genuine Advantage v1.3.0254.0
Windows Live Messenger
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows XP Service Pack 2
WinRAR archiver
Winter 3D Screensaver 1.0
WinZip
World Saver 3D version 3.4
www.UselessCreations.com - Moolah! The 3D Money Screensaver v1.5
XviD 1.1 final uninstall
Yahoo! Messenger
YAMP v2.1
Please do one more thing.
After starting Hijack This!, click on Open the Misc Tools Section.
To the right of Generate Startuplist log, there are two boxes.
Check them both, then click Generate Startuplist log.
StartupList report, 11/15/2006, 9:02:52 PM
StartupList version: 1.52.2
Started from : C:\Documents and Settings\wisdomsword\Desktop\hijackthis\HijackThis.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
* Using default options
* Including empty and uninteresting sections
* Showing rarely important sections
==================================================
load=*INI section not found*
run=*INI section not found*
Load/Run keys from Registry:
HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\Windows: load=
HKCU\..\Windows NT\CurrentVersion\Windows: run=
HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=
————————————————–
Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:
Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*
Shell & screensaver key from Registry:
Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\DREAMA~1.SCR
drivers=*Registry value not found*
Policies Shell key:
HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*
————————————————–
Checking for EXPLORER.EXE instances:
C:\WINDOWS\Explorer.exe: PRESENT!
C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present
C:\WINDOWS\Fonts\Explorer.exe: not present
————————————————–
Checking for superhidden extensions:
.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden
————————————————–
Verifying REGEDIT.EXE integrity:
- Regedit.exe found in C:\WINDOWS
- .reg open command is normal (regedit.exe %1)
- Company name OK: 'Microsoft Corporation'
- Original filename OK: 'REGEDIT.EXE'
- File description: 'Registry Editor'
Registry check passed
————————————————–
Enumerating Browser Helper Objects:
(no name) - C:\Program Files\DAP\DAPBHO.dll - {0000CC75-ACF3-4cac-A0A9-DD3868E06852}
(no name) - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\PROGRA~1\SPYBOT~1\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F}
(no name) - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
NAV Helper - C:\Program Files\Norton AntiVirus\NavShExt.dll - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD}
————————————————–
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
*Registry key not found*
————————————————–
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
*Registry key not found*
————————————————–
End of report, 39,531 bytes
Report generated in 0.200 seconds
Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only
For version with the Installer:
Use the setup program to install ERUNT on your computer
For the zipped version:
Unzip all the files into a folder of your choice.
Click Erunt.exe to backup your registry to the folder of your choice.
Note: to restore your registry, go to the folder and start ERDNT.exe
I recommend you download RegSeeker. Extract it to it's own folder, open and double click RegSeeker.exe to start the program. Maximize the window and click clean registry. Check all sections and click OK. When the scan is complete, verify the backup box in lower left corner is checked and click the select all button, then select all again. Then right click within the search results and select delete. Run it again and again, deleting everything it finds until it finds nothing. Reboot and make sure your programs are working properly, control panel and add/remove programs windows open, etc (basically just do a quick check of everything). In the event anything was 'broken', you can open RegSeeker, click backups and double click any/all files to put the information back. A reboot may be required for the effects to be seen. Reboot When done.
NOTE: To be extra safe you can choose to only remove the items in RED.