[RESOLVED] - I've got a bit of a problem !

[Boris]

XP Pro runs perfectly OK for hours and then suddenly it crashes, I get the "Serious Error" message and the "illuminating" info attached below comes on the screen after its rebooted.

It seems on reflection to happen most often as I'm disconnecting from the web - either enforced at the end of the 2 hour dial-up session or by my choice. So I thought it was my modem. I changed it and the same things happen.

Once its crashed I don't seem to be able to reconnect. The PC restarts OK and is perfect until I've clicked on IE but once I then touch the "connect" button - off we go again. When I re-install the modem - its back to normal (for a time)

I've competely rebuilt the PC - everything apart + put it into another case and it still happens.

It also crashes sometimes when I turn the PC off - same message each time.

I've got all the Windows updates, no obvious viruses/trojans - tried a2, Spybot, AVG and eTrust EZ AntiVirus - nothing found !

Heres the HiJack This log as well :-

Logfile of HijackThis v1.97.7

Scan saved at 22:28:48, on 20/12/2003

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\LEXPPS.EXE

C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe

C:\Program Files\Ahead\InCD\InCD.exe

C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe

C:\Program Files\ASUS\Probe\AsusProb.exe

C:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetTray.exe

C:\Program Files\Ahead\InCD\InCDsrv.exe

C:\Program Files\Washer\washer.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\Program Files\Buzzsaw\Buzzsaw.exe

C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Firewall\ca.exe

C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\System32\svchost.exe

C:\PROGRA~1\TrayMan\ntstart.exe

C:\WINDOWS\System32\VetMsgNT.exe

C:\PROGRA~1\TrayMan\trayman.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\Program Files\Ad Muncher\AdMunch.exe

C:\Program Files\NetPerSec\NetPerSec.exe

C:\Program Files\SlimBrowser\sbrowser.exe

D:\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"

O4 - HKLM\..\Run: [inCD] C:\Program Files\Ahead\InCD\InCD.exe

O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe

O4 - HKLM\..\Run: [VetTray] C:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetTray.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKCU\..\Run: [Washer] C:\Program Files\Washer\washer.exe /0

O4 - Startup: TICK.lnk = ?

O4 - Global Startup: Ample Notice.lnk = ? This is my diary program

O4 - Global Startup: Billminder.lnk = ? This is from Quicken

O4 - Global Startup: Buzzsaw.lnk = ?

O4 - Global Startup: EZ Firewall.lnk = C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Firewall\ca.exe

O4 - Global Startup: Lotus QuickStart.lnk = ?

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O8 - Extra context menu item: Download using Download &Express - file://C:\Program Files\Download Express\Add_Url.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Research (HKLM)

O9 - Extra button: Messenger (HKLM)

O9 - Extra 'Tools' menuitem: Messenger (HKLM)

O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll

O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB

O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/...7926.6528472222

O17 - HKLM\System\CCS\Services\Tcpip\..\{F4E1A02E-D5BD-4C69-9710-D2C93208F2EF}: NameServer = 195.92.195.95 195.92.195.94

Don't think its heat - Asusprob is running all the time and I get no warnings from it at all - the CPU runs at a temperate 26 C !

Spec

Asus P4S533-MX

Intel Celeron 2.0

512MB PC133 SD-RAM

Excelstor J360 ATA100 60GB

LeadTek A340 Geforce4 MX440 64MB DDR

Freecom 40B1 40x16x40 CD/RW

Asus DVD-E616P1 DVD-ROM.....

56k Dial-up

Windows XP Pro SP1

Anyone got any bright ideas ?

If I disappear suddenly, you'll know why ! :D :D :D

[Boris]

I've even swapped the memory with someone else - but to no avail.

[mark2]

Don't really see anything odd in there Boris

O4 - Startup: TICK.lnk = ?

C:\Program Files\NetPerSec\NetPerSec.exe could this possibly be involved ? I note it's a connection speedo,

Could it be ZA kicking up ? C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Firewall\ca.exe

What error messages in event viewer do you get that correspond to the timing of the probs ?

[Boris]

Don't really see anything odd in there Boris

O4 - Startup: TICK.lnk = ? 

C:\Program Files\NetPerSec\NetPerSec.exe could this possibly  be involved ? I note it's a connection speedo, 

Could it be ZA kicking up ?

What error messages in event viewer do you get that correspond to the timing of the probs ?

O4 - Startup: TICK.lnk = ? :wub: :wub: :wub: - I think its ZA ?

Event Viewer has a huge chunk of "True Vector Engine" errors (about 250) since 1.12.03 when I installed the 1 year of free use EZ Firewall (its actually ZA Pro - but an old version of it - 3.7.179 )

I think you've cracked it !

I kept thinking that it must be hardware :blush: :blush: :blush:

[Boris]

0000: 46 69 6c 65 20 22 43 3a File "C:

0008: 5c 57 49 4e 44 4f 57 53 \WINDOWS

0010: 5c 49 6e 74 65 72 6e 65 \Interne

0018: 74 20 4c 6f 67 73 5c 43 t Logs\C

0020: 45 4c 45 52 4f 4e 2e 6c ELERON.l

0028: 64 62 22 20 77 61 73 20 db" was

0030: 63 6f 72 72 75 70 74 20 corrupt

0038: 61 6e 64 20 68 61 73 20 and has

0040: 63 6f 70 69 65 64 20 74 copied t

0048: 6f 20 22 43 3a 5c 57 49 o "C:\WI

0050: 4e 44 4f 57 53 5c 49 6e NDOWS\In

0058: 74 65 72 6e 65 74 20 4c ternet L

0060: 6f 67 73 5c 78 44 42 35 ogs\xDB5

0068: 2e 74 6d 70 22 2e 00 .tmp"..

Hundreds of these !

[mark2]

use HJT to fix that reference to ZA and it should solve the prob

ZA doesn't like to be removed :angry:

[Boris]

just realised that Outpost was also running as well as ZA ! - Nothing in the System Tray - I thought that I'd stopped it starting - but obviously not ! I have now though !!!

I'm going to stick with this EZ ZA for a while longer to see what else happens ??? - hopefully nothing ! Any more trouble and its out and Outpost will return.

[mark2]

HJT can even help with hardware :D :D problems

useful tool

can't see outpost in your log tho :blink:

[Boris]

No - there was in the original - I think I had a little cut/paste problem ?

2 other lines also missed - human error !!! Too much lager ???

ZA has gone - Outpost is fully back.

[mark2]

:cheers2: :cheers2: nver drik at the keybroad

[Boris]

Problem was caused by Outpost :( - I started getting "error 56 - engine failed to load" regularly on booting which i tracked down to Outpost.

Thought a file might be corrupted, so I uninstalled Outpost, cleaned it out of the Registry and reinstalled it.

The same problem however !

So I uninstalled Outpost, and cleaned it out of the Registry again.

Loaded the latest Zone Alarm (free) 4.5.5538 and I've had absolutely no problems in 4 days ! :)