technophobe1

Hi to all

I'm not sure if I'm in the correct area with this but here I go anyway. I have recently noticed a unknown media player briefly becoming visible during boot up this I got to stop by giving my computer a good clear out with various junk cleaners and I then removed and reinstalled my antivirus software. I have however been getting a script error informing that the memory can't be read when I download and try to play wmv or vlc files the unknown media player also appears; I can get around this through closing and reopening the file but by then windows has put the report error to Microsoft and debug box up. Can anyone shed some light on this? Have I corrupted some XP files?

I have Windows XP home edition SP3
running with low disc space presently

POADB

Hi technophobe1,

This is the issue with "Junk Cleaners", you don't exactly know what they are cleaning. My guess would be that the cleaners have gone through your registry and removed something it shouldn't have. Did the programs you used prompt you to make any backups? Did you make any backups?

1st thing to try - reinstall Windows Media Player and VLC.
2nd, look in the event viewer under applications and see if there are any Errors. Post them here.

technophobe1

Hi thanks POABD

Unfortunately, I didn't make a backup because I haven't had any problems before. The registry cleaners leave everything in tact. I can say though that I recently downloaded some files that had an html extension on them and they downloaded as html web page icons; I had to uncheck the hide extension for know file types check box in the folder area in control panel and this changed the web page icons to vlc icons and I could play the files. The only other thing I can think of is when I double clicked on one of these html icons before I was informed I had to change them and it caused windows a lot of confusion and shut down IE since then I have been having the problem. I have checked the hide extensions for know file type box again. The mystery media player isn't one I recognise.

I will reinstall vlc and wmp if you still think it is necessary. The events viewer you are referring to is it in the task pane?

Virus scans and malwarebytes are coming back negative using quick scan options.

Thanks

POADB

The event viewer can be found in:

Control Panel > Administrative Tools > Event Viewer.

Look under Application and System for any recent errors. Open the errors and click the 3rd icon, below the arrows to copy the report.

technophobe1

Okay here are the systems
These seem to be repetitive and too many to post.




Event Type: Warning
Event Source: Tcpip
Event Category: None
Event ID: 4226
Date: 10/02/2010
Time: 1006
User: N/A
Computer: D9MHBN1J
Description:
TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 01 00 54 00 ......T.
0008: 00 00 00 00 82 10 00 80 ....‚..€
0010: 01 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 10/02/2010
Time: 09:53:40
User: NT AUTHORITY\SYSTEM
Computer: D9MHBN1J
Description:
The server {3A185DDE-E020-4985-A8F2-E27CDC4A0F3A} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7026
Date: 10/02/2010
Time: 09:49:55
User: N/A
Computer: D9MHBN1J
Description:
The following boot-start or system-start driver(s) failed to load:
Beep

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 10/02/2010
Time: 09:49:52
User: N/A
Computer: D9MHBN1J
Description:
The General Purpose USB Driver (adildr.sys) service failed to start due to the following error:
The system cannot find the file specified.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Dhcp
Event Category: None
Event ID: 1002
Date: 10/02/2010
Time: 09:49:36
User: N/A
Computer: D9MHBN1J
Description:
The IP address lease 192.168.254.1 for the Network Card with network address 0013201B9968 has been denied by the DHCP server 192.168.254.254 (The DHCP Server sent a DHCPNACK message).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7026
Date: 10/02/2010
Time: 00:48:51
User: N/A
Computer: D9MHBN1J
Description:
The following boot-start or system-start driver(s) failed to load:
Beep

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 10/02/2010
Time: 00:48:49
User: N/A
Computer: D9MHBN1J
Description:
The General Purpose USB Driver (adildr.sys) service failed to start due to the following error:
The system cannot find the file specified.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Warning
Event Source: Tcpip
Event Category: None
Event ID: 4226
Date: 09/02/2010
Time: 21:18:26
User: N/A
Computer: D9MHBN1J
Description:
TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 01 00 54 00 ......T.
0008: 00 00 00 00 82 10 00 80 ....‚..€
0010: 01 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........


Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7026
Date: 09/02/2010
Time: 20:48:10
User: N/A
Computer: D9MHBN1J
Description:
The following boot-start or system-start driver(s) failed to load:
Beep

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 09/02/2010
Time: 20:48:06
User: N/A
Computer: D9MHBN1J
Description:
The General Purpose USB Driver (adildr.sys) service failed to start due to the following error:
The system cannot find the file specified.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Dhcp
Event Category: None
Event ID: 1002
Date: 09/02/2010
Time: 20:47:50
User: N/A
Computer: D9MHBN1J
Description:
The IP address lease 192.168.254.1 for the Network Card with network address 0013201B9968 has been denied by the DHCP server 192.168.254.254 (The DHCP Server sent a DHCPNACK message).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 09/02/2010
Time: 13:16:39
User: NT AUTHORITY\SYSTEM
Computer: D9MHBN1J
Description:
The server {209500FC-6B45-4693-8871-6296C4843751} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 09/02/2010
Time: 13:16:37
User: NT AUTHORITY\SYSTEM
Computer: D9MHBN1J
Description:
The server {3A185DDE-E020-4985-A8F2-E27CDC4A0F3A} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7026
Date: 09/02/2010
Time: 13:13:57
User: N/A
Computer: D9MHBN1J
Description:
The following boot-start or system-start driver(s) failed to load:
Beep

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 09/02/2010
Time: 13:13:53
User: N/A
Computer: D9MHBN1J
Description:
The General Purpose USB Driver (adildr.sys) service failed to start due to the following error:
The system cannot find the file specified.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Dhcp
Event Category: None
Event ID: 1002
Date: 09/02/2010
Time: 13:13:37
User: N/A
Computer: D9MHBN1J
Description:
The IP address lease 192.168.254.1 for the Network Card with network address 0013201B9968 has been denied by the DHCP server 192.168.254.254 (The DHCP Server sent a DHCPNACK message).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

technophobe1

Here are the applications there not all here but these are the recent ones.


Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1001
Date: 08/02/2010
Time: 11:41:16
User: N/A
Computer: D9MHBN1J
Description:
Fault bucket 930110833.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 42 75 63 6b 65 74 3a 20 Bucket:
0008: 39 33 30 31 31 30 38 33 93011083
0010: 33 0d 0a 3..


Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 08/02/2010
Time: 11:41:00
User: N/A
Computer: D9MHBN1J
Description:
Faulting application explorer.exe, version 6.0.2900.5512, faulting module shell32.dll, version 6.0.2900.5622, fault address 0x0002b2e6.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 65 78 70 ure exp
0018: 6c 6f 72 65 72 2e 65 78 lorer.ex
0020: 65 20 36 2e 30 2e 32 39 e 6.0.29
0028: 30 30 2e 35 35 31 32 20 00.5512
0030: 69 6e 20 73 68 65 6c 6c in shell
0038: 33 32 2e 64 6c 6c 20 36 32.dll 6
0040: 2e 30 2e 32 39 30 30 2e .0.2900.
0048: 35 36 32 32 20 61 74 20 5622 at
0050: 6f 66 66 73 65 74 20 30 offset 0
0058: 30 30 32 62 32 65 36 0d 002b2e6.
0060: 0a .


Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 07/02/2010
Time: 22:59:04
User: N/A
Computer: D9MHBN1J
Description:
Faulting application drwtsn32.exe, version 5.1.2600.0, faulting module dbghelp.dll, version 5.1.2600.5512, fault address 0x0001295d.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 64 72 77 ure drw
0018: 74 73 6e 33 32 2e 65 78 tsn32.ex
0020: 65 20 35 2e 31 2e 32 36 e 5.1.26
0028: 30 30 2e 30 20 69 6e 20 00.0 in
0030: 64 62 67 68 65 6c 70 2e dbghelp.
0038: 64 6c 6c 20 35 2e 31 2e dll 5.1.
0040: 32 36 30 30 2e 35 35 31 2600.551
0048: 32 20 61 74 20 6f 66 66 2 at off
0050: 73 65 74 20 30 30 30 31 set 0001
0058: 32 39 35 64 295d


Event Type: Error
Event Source: crypt32
Event Category: None
Event ID: 8
Date: 07/02/2010
Time: 18:39:06
User: N/A
Computer: D9MHBN1J
Description:
Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.co...throotseq.txt> with error: This network connection does not exist.


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: crypt32
Event Category: None
Event ID: 8
Date: 07/02/2010
Time: 18:39:04
User: N/A
Computer: D9MHBN1J
Description:
Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.co...throotseq.txt> with error: This network connection does not exist.


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: crypt32
Event Category: None
Event ID: 8
Date: 07/02/2010
Time: 18:39:01
User: N/A
Computer: D9MHBN1J
Description:
Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.co...throotseq.txt> with error: This network connection does not exist.


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: crypt32
Event Category: None
Event ID: 8
Date: 07/02/2010
Time: 18:39:00
User: N/A
Computer: D9MHBN1J
Description:
Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.co...throotseq.txt> with error: The server name or address could not be resolved


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Warning
Event Source: EventSystem
Event Category: (52)
Event ID: 4356
Date: 07/02/2010
Time: 13:44:27
User: N/A
Computer: D9MHBN1J
Description:
The COM+ Event System failed to create an instance of the subscriber partition:{41E90F3E-56C1-4633-81C3-6E8BAC8BDD70}!new:{58FC39EB-9DBD-4EA7-B7B4-9404CC6ACFAB}. CoGetObject returned HRESULT 8000401A.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

POADB

There are 2 things that strike me as odd with your error logs.

1) Event ID: 4226
2) Event ID: 8

Event 4226 refers to the way SP2 handles TCP/IP. A "Security Enhancement" which limits the traffic or connections.

The reasons you are getting this error could be:
1) You have a virus
2) You use P2P file sharing software (which ultimately leads to 1) or you're a heavy network user.

The second error I find odd, event ID 8, is your computer not being able to connect to Windows Update - which is a tactic employed by malware. Or, you could be disconnected from the Internet at that time???? To check we can do the following:

Turn off the Update Root Certificates component: To turn off the Update Root Certificates component, follow these steps:

1. In Control Panel, double-click Add/Remove Programs.
2. Click Add/Remove Windows Components.
3. Click to clear the Update Root Certificates check box, and then continue with the Windows Components Wizard.

There are other errors, of course, which relate to Drivers (make sure your device drivers are up to date and working) and your computer failing to get a DHCP address and other System errors but I'm not concerned with those at the moment, as I don't think they relate to your issue.

As you have a mystery media player, have re-installed your AV and are getting these 2 suspicious errors - I'd like to first rule out malware.

Could you please do the following:

http://www.techsupportforum.com/secu...oval-help.html

technophobe1

Windows shows my updates as all installing successfuly windows updates usually download and install without a problem I'm baffled. I do use bit torrent on occasions and file sharing soft ware occasionally. I've unchecked the update root certificates box and followed the wizard's instructions but as I don't know what to do next I have rechecked the update root certificates box until you give me some more instructions. Do I have the windows updates? I'm baffled

Thanks

technophobe1

I forgot to mention earlier that I have been getting various messages asking me to end a program or debug and end a program when I shut down. The one I have been getting most of all is 0x6280436a the memory could not be written to- with another similar number that is different each time but the first one mentioned is there all the time. I have received some more automatic updates from windows and they seem to download and install fine but on reboot I got this message 0x7c91b21 reference to memory 0x00000010 ...Well something like that I'm baffled it does not stay on the screen long enough for me to copy it all down.

Thanks

POADB

If applications were crashing I'd expect to see the error in the Application error logs...
Glad Windows Updates are working and if you're using P2P software, this will explain the TCP Connection warnings...

So, if you're getting lots of memory errors - lets test the RAM.

Lets try this little program and see what we get:

http://hcidesign.com/memtest/

Or, alternatively:

http://oca.microsoft.com/en/windiag.asp

or:

http://www.memtest.org/

technophobe1

Will I need to disable my antivirus software before I run one of these programs? On a different note the last batch of 10 windows updates seem to download and install okay but I was wondering if there might be a problem with the previous updates according to the Crypt 32 error. I have never had any problems with updates I think I have only ever had 2 that failed to install and when I tried them again they were successfully installed. Microsoft always gives me the message everything was installed sucessfully and that I'm up to date. Should I leave the update root certificates box unchecked? It is checked at the moment. How long should I leave hcidesign running for? Is an hour okay?

Thanks

jcgriff2

memtest86+ is a bootable CD - nothing to do with Windows, per se.

POADB

I would disable your AV while the scan is running. If WU are working for you then you can ignore the root certificate work around. Those errors int he system log must have occured when you were offline.

I would try windiag also, and if hcidesign doesn't find any issues after an hour run windiag and see if it finds anything.

If no memory issues are found, I would defintely let the Security Team check your system over, just to rule malware out.

technophobe1

Does this mean I have all the necessary Windows Updates? Windows is telling me one thing my system log another I'm confused.

Thanks

POADB

Yes. You can see them in Add/Remove if you have the box "Show Updates" checked.

The error was reporting an attempt to connect to the Windows Updates site had failed. This could be you were offline when the connection was attempted, or the server was unavailable. There are several of them.

You're getting pre-occupied . Lets do the memory checks to make sure the RAM is not to blame as the errors suggest.

If this comes back OK, no errors, I'll insist on ruling out malware, which can also cause these symptoms. If the Security team give you the all clear we'll have to take a deeper look at your system.

technophobe1

Hi POAB

I was just about to do my Ram check but a new problem seems to have arisen. In my documents most of the files have a red circle with a white exclaimation mark in them. I was trying out some keyboard shortcuts and now this has happened. Please advise and then I will run my RAM tests. I hit some keys by accident as my keyboarding whent out of sync.

Thanks

technophobe1

I've cleared some junk off my hard drive but the exclaimation marks are still there.

POADB

Seems like you have installed Mozy, a backup utility. It's indicating that those files are yet to be backed up. Files with Green Ticks have been backed up.

To disable go to:
CONFIGURE > OPTIONS > GENERAL > and uncheck the box for "Show Backup Status Icon on files and folders"

I've been given guidance from a colleague who has suggested that memtest86 be used. One memory module should be tested at a time, and the contacts of the modules should be cleaned with an eraser/rubber. The test should be ran 4 to 5 times on each module.

technophobe1

Which Memtest should I download? Prebuilt and Isos or source code. I've never used this stuff before where do I get the eraser from?

POADB

Please see:

An Eraser - is for rubbing out pencil. You can get them almost eveywhere, supermarket local shop - or obviously a stationary store.

It's use in the mem test is to rub away any coating or "finish" on the contacts to ensure a clean contact is made between ram module and motherboard ram slots.