Thanks JohnW, those posts are all helpful. i used the RAV virus check. apparently i contracted 20 viruses and 7 virus bodies. but i distinctly remember downloading every patch for Klez and soBig. but the one that worries me the most is HLLW.Nachi this is different than the other infected files. it's in my DLLHOST.exe system file. the rest is from temp files and in my [identities] folder of Application Data> the virus remover on my computer is old, and i bought a new virus scanner. the problem is, i can only uninstall my old one out of safe mode. so i'm afraid of a risk of two virus removers becoming active. i suspect that the HLLW.Nachi is the cause of my problem while the others are just spamming through my mail. thanks for the help again, and i'll look for a nachi fix patch.

0

oh i also check the events manager. these are the *errors* that come up the most during the time of my problem. EventSystem 4609 Application Error 1000 VSS 8193 though i don't quite understand the "reason" that it gives for each of these errors.

0

Windows XP Events and Errors Enter the message source and ID in the text field, then click G http://www.microsoft.com/windowsxp/pro/support/ee.asp ================================ HOW TO: View and Manage Event Logs in Event Viewer in Windows XP http://support.microsoft.com/default.aspx?scid=kb;EN-US;308427 ================================ If you want to stop the blue screen auto reboot so you can read the error message from the screen: Go to Start -> Control Panel -> System Go to Advanced Under the Startup and Recovery section, click Settings... Under System Failure un-check "Automatically restart"

0

Opp's , already given you those .

0

This may be of value , johnny . eScan Antivirus Toolkit Utility http://www.it-mate.co.uk/main_content/security.asp#dialerspy http://www.mwti.net/index.asp MicroWorld has developed a Free eScan AntiVirus Toolkit Utility, that will help you diagnose if your machine is infected by a virus. This tool also cleans your registry and other system areas of the damage that a virus might have done. The best part of eScan toolkit utility, is its ability to; A. Check running processes in memory. B. Check illegal dialers running in memory and inform the user. C. Inform users of any background (legal) sniffers or tools running in memory. Ed: This program can be slow on older systems with large hard drives

0

i tried the eScan and it found a welchia virus in my system. i will try rebooting now, but i switched back and forth between my profiles. but i'll scan again and scan again.

0

i was able to get the the task manager and i wrote down some suspicious processes. webtrapNT.exe Pop3Trap.exe PNTIOMON.exe SVCHOST.exe TMNTSRV.exe DLLHOST.exe LTSMMSG.exe i thought these were odd because the names were all capitalized and i had already three more processes of svchost.exe i checked and found that some of these have something to do with "PC-trillin", a virus checker that is given with my computer. *such as the webtrapNT and pop3trap*

0

Use Google to check out your suspicions johnny . Work your way through them & see how you go .

0

hmm.. i can't find a way to remove PC-Cillin. and i want to because i'm afraid it's something to do with that. other stuff, i have 6 errors on my computer that i don't know how to fix. i was only able to remove the nachi worm. i'll try each of the other scans / cleaners. thanks

0

http://www.google.com.au/search?q=remove+PC-Cillin&ie=UTF-8&oe=UTF-8&hl=en&btnG=Google+Search&meta= http://support.eyecom.com/pccillin.html http://support.microsoft.com/?kbid=324632

0

http://kb.trendmicro.com/solutions/solutionDetail.asp?solutionID=6382 this was the steps i took to manually uninstall PC-Cillin. i'm going to install a new virus scanner and then try to see if i can fully use normal mode. thanks for you help again John

0

I found some errors in my registry. here they are: C:\windows\system32\khooker.exe c:\program files\Winamp\winampa.exe c:\windows\system32\IME\PINTLGNT\Imsclnst.exe /SYNC c:\WIndows\System32\IME\TINTLGNT\TINTSETP.exe /SYNC c:\WIndows\System32\IME\TINTLGNT\TINTSETP.exe /IMEName point32.exe i've done 'msconfig' and disable each of these on startup. i'm not sure if there was anything else i should have done to them. i tried using Normal mode. it felt faster than before, but the same problem arises.

0

" not sure if there was anything else i should have done to them " Maybe using Services will help . To access Services . Start > My Computor , right click & select Manage . Click on the + next to Services and Applications . Click on Services . ============================================ A quick google search on 2 items , revealed this . khooker.exe http://www.pacs-portal.co.uk/startup_pages/startup_k.php winampa.exe http://www.pacs-portal.co.uk/startup_pages/startup_w.php =========================================== I use these freeware programs . http://www.avast.com/iavs4pro/setupeng.exe http://www.avast.com/i_idt_153.html http://www.all4you.dk/FreewareWorld/links.php?page=1&cat=24 http://www.tusafe.com/nonags/index.html Home edition is a full-featured antivirus package designed for home usage. Our company offers Home Edition free of charge, since in our opinion, it is possible to avoid global virus spreading by efficient prevention. However, many user are not able or do not want to pay for antivirus software. Avast! is the complete antivirus software package for DOS, Windows 3.x, Windows 9x/Me and Windows NT/ 2000/XP Antivirus kernel ======================================== http://www.kerio.com/kpf_home.html Kerio Personal Firewall (KPF) is a software agent that builds a barrier between your personal computer and the Internet. KPF is designed to protect your PC against attacks from both the Internet, and other computers in the local network. KPF controls all data flow in both directions from the Internet to your computer and vice versa, and it can block all attempted communication allowing only what you choose to permit. This makes KPF an ideal solution for notebook computers that freely travel in and out of the corporate network, facing exposure to various risks as they connect from different locations. Kerio Personal Firewall protects againstinformation theft, modification or destruction Trojan horse applications spyware unauthorized access from within the local network denial of service attacks to applications or services Available FREE for home use. For Windows 98, Me, NT, 2000 and XP. NOTE: Windows 95 is no longer supported due to the termination of its support by its producer.

0

i'm not sure how using services helps. i've already updated the Windows. i'm leaving the registries with errors disabled, but i'm still stuck. i have a virus and a firewall already. i looked up khooker and it says it's optional to leave there; as well the winampa. but is there a way for me to get a "clean" version of the other .exe files? i've already do a reinstallation of WINXP. but if i did it now, will it fix the errors on those registries?

0

Hard to know if it will fix , probably worth a go . Have a read of these . You May Lose Data or Program Settings After Reinstalling, Repairing, or Upgrading Windows XP http://support.microsoft.com/default.aspx?scid=kb;EN-US;312369 Data Loss May Occur After Reinstalling, Repairing, or Upgrading Windows XP http://support.microsoft.com/default.aspx?scid=kb;EN-US;312368 The information in this article applies to: Microsoft Windows XP Home Edition Microsoft Windows XP Professional

0

i can't fix these registries. that's the only diagnosis i can give myself is: my computer won't work because of the errors in the registries: c:\windows\system32\IME\PINTLGNT\Imsclnst.exe /SYNC c:\WIndows\System32\IME\TINTLGNT\TINTSETP.exe /SYNC c:\WIndows\System32\IME\TINTLGNT\TINTSETP.exe /IMEName or i have a totally different problem that i'm not sure about.

0

Try a reinstall . Reinstall XP and keep all your current installed applications and settings . http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/winxppro/proddocs/winnt32.asp

0

i searched around and saw alot of these "hijackthis" logs. so i'm not sure if it'll help diagnois my problem or not. i placed a (*) star in front of those registry that returned an error on a scan. i've also noticed that i have "blank" startup items in the startup tab of 'msconfig'. i'm not sure what they mean. anyways, i'll try reinstalling XP again. and see if that helps. thanks. Logfile of HijackThis v1.97.6 Scan saved at 11:41:59 PM, on 11/16/2003 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\System32\ctfmon.exe C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\wins\DLLHOST.exe C:\PROGRA~1\WINZIP\wzqkpick.exe C:\Documents and Settings\Administrator.YUKISOHMA\Desktop\hi\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\adobe\acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [LTSMMSG] LTSMMSG.exe O4 - HKLM\..\Run: [ZTgServerSwitch] c:\program files\support.com\client\lserver\server.vbs O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [QuickFinder Scheduler] "C:\Program Files\Corel\WordPerfect Office 2002\Programs\QFSCHD100.exe" O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.exe *O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC *O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.exe /SYNC *O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.exe /IMEName O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.exe C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.exe O4 - Global Startup: VAIO Action Setup (Server).lnk = ? O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.exe O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM) O9 - Extra button: AIM (HKLM) O9 - Extra button: Free Surfer (HKLM) O9 - Extra 'Tools' menuitem: Free Surfer (HKLM) O9 - Extra button: Related (HKLM) O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM) O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potb_x.cab O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://active.macromedia.com/director/cabs/sw.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/bcd48c18cb7498/housecall.antivirus.com/housecall/xscan53.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37883.7526273148 O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {FA13A9FA-CA9B-11D2-9780-00104B242EA3} (WildTangent Control) - http://www.wildtangent.com/install/wdriver/ddc/shockwave/wtinst.cab

0

Here is logfile check list . http://hjt.wizardsofwebsites.com/

0

I finally found the root of my problem! the dwwin.exe is corrupt in a way that it prevent certain programs from being seen as an application be used. the processes still see it active, but the application itself does not arise. example: i went and click on IEXPLORER.exe. the process appeared on my taskmanager, but not in the applications. then i tried to use OutLook Express, but no process showed up and neither did the application. so i did a test and ended the process dwwin.exe. and what happened the safe mode reload, and i received the opening statement and got into outlook. i know that dwwin.exe is a legit windows file and despite all my updates, i could not "fix" that problem. i guess i will totally reinstall windows. and see if it can replace the dwwin.exe corrupted.

0

Worth a try , good luck .

0

well, no more problem. i reinstalled it so that bug doesn't come up anymore. though the bad thing about reinstalling is all my settings are gone and it seems the drivers all reverted back. i found all my programs are still here, but not in the start meau. and noticed my previous profiles are still in the computer. but i have no way of reviving them back to this new side. i also found a folder in my 2nd partition(storage disk) called 687d123fb79642b188. it won't let me access the folders inside, named sp1 and sp2. i'm not sure if that is supposed to happen. also, i was wondering if you knew of a way to find my old emails. i use outlook and it downloads my emails for me, but i'd really like to retrieve them back. is there any way for me to get those back? sorry about all this trivial questions. it's just that this part will sound like the hardest part. thanks again. i appreciate your help with my difficulties.

0

Sounds like you did'nt use the winnt32 command . Never had to use it myself & having just done some reading , it is a bit confusing . For the future , here is what I learnt , in a easier to understand format . ========================================= Reinstall XP and keep all your current installed applications and settings . http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/winxppro/proddocs/winnt32.asp http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/winxppro/reskit/prbc_cai_tidq.asp http://www.onecomputerguy.com/windowsxp_tips.htm ReInstalling WindowsXP Added 5/21/02 If you need to reinstall WindowsXP and want to keep all your current installed applications and settings: 1 . Start WindowsXP 2 . Go to the location of your source files 3 . Run WINNT32 /unattend I've often need to do this to repair something that had gotten corrupted and didn't want to do a clean install. Or , Start > All Programs > Accessories > Command Prompt . At the command prompt type: winnt32 /unattend Press Enter . Or , Start, click Run, type cmd, and then click OK type: winnt32 /unattend Press Enter . =========================================== Sp1/2 are either your XP or Outlook sevice pack updates from MS . Once you have youself sorted out , go to Updates & it will tell you what you need . ============================================ Don't use Outlook myself . Outlook Help Pages . http://pubs.logicalexpressions.com/Pub0009/LPMArticle.asp?ID=52 http://www.ecu.edu/exchange/autoarchive/autoarchive.asp http://www.computertim.com/howto/articles/outlook.shtml http://www.rselby.com/Outlook.html http://www.uwec.edu/help/outlook.htm http://www.oucs.ox.ac.uk/viruses/avdocs/emailvirs/index.xml?style=text http://mmmservices.web.cern.ch/mmmservices/Help/contents/0_1_outlook2002.asp http://www.slipstick.com/outlook/olshare1.htm http://office.microsoft.com/assistance/2000/olaccount.aspx ====================================== To repair a damaged Personal Folders PST file . http://www.slipstick.com/problems/scanpst.htm http://www.slipstick.com/ http://www.slipstick.com/outlook/index.htm ================================== Repair Outlook . http://howto.lycos.com/lycos/step/1,,71+26230+10698,00.html http://www.gemair.com/support/documentation/outlook/inreptool.shtml

0

ahh.. i tried to run winnt32 but i didn't know about the /attend portion. so i ended up getting very frustrated about it. i don't suppose there is a way back :P oh well, hahaha.. thanks. i guess i can pick up from where i left off.

0