ra12r

January 9, 2012

LDTate, OK I believe my computer is okay now. I had a few struggles but have (with your help) gotten the "monkey out of the tree"!!! Here is a few things that I have learned which I hope helps you also....

Symptom:

1) Root Kit Virus....... It was removed by the processes you directed.

2) Multiple Malware....... Removed by the processes you directed.

3) Location of a problem........ Discovered that my "cache" of my firefox profile contained something that was recreating issues when I restored a deleted profile to get back some manually deleted bookmarks. So a complete reinstall was required. OTL plus your suggested additions immediately stopped it again.

4) Slow screen redraw.......... Removed IE8 and it 'IMMEDIATELY FIXED" my screen issues. I found that by googling. There is a script required for XP that will remove it on the MS website. Currently I have not reinstalled any IE but I will try to go back to IE6.

5) Lost CD storage device....... I had to get in regedit and remove a "Lower filter" which fixed my issue immediately and now burning is EXTREMELY FAST. ie google

6) IP Router virus...... turning on and off the ip stuff fixed that blockage of internet access to certain websites.

7) USB lockout after time idle.......... turning off power management control has stopped that...

I cant think of anything else right now, but I believe all my problems are solved!!! Thank you very much and I will probably be purchasing a full version of MBAM just for appreciation. Once again thank you for you diligence helping me get all these things back out of my system as I have learned a BUNCH of additional things working this process with you. Mucho Gracias!!!!

January 5, 2012

LDTate, I am sooo sorry that my computer has been such a challenge. But, it is doing much better and I that you for your help. The screen refresh has stopped. It boots much faster. The newly installed firefox 3.6 verson is not hanging while going to webpages. I am still having some intermittant USB issues. I have not reinstalled a cdrom driver yet. Do you currently see anything else of concern?

However, prior to installing the cdrom driver,I have been trying to work the past couple of days when i get home from work to get things all back balanced. But I still have some issues that I need your help with... On one of our cleaning scans prior to christmas break, I lost all my bookmarks in firefox and firefox kept saying it was already open when I would try to start the program. I tried to find them by doing a system restore, but the system restore points no longer work. I figured the bookmarks json or html files were deleted from the profile and could be found on the harddrive with a program. So I have found some files but the bookmark files that will restore, no luck yet. The one i found that is the prior, firefox says it can not process it. I am wondering what I need to do to get them restored. I don't think any of my virus's was located in the mozilla folder, but I am not sure about that??? I have been using a program that finds and undeletes stuff that has been deleted and is still on the hardddrive. But, the info I have found so far to know what all needs to be present without undeleting all the Mozilla files has not addressed my issue of restoring deleted mozilla bookmarks files. Thanks again for your time and efforts to help me.

January 3, 2012

LDTate, ok I will have to get a driver from driversguide, no problem. However, i did notice that my usb mouse and keyboard locked up again. When I unplug and replug it found it straightway though, but something is still grabbing that usb bus or something.....

January 2, 2012

LDTate, I still don't have a cdrom drive after bootup. I have it when I go to the bios before bootup but loose it after bootup? Haven't noticed anything else yet.

January 2, 2012

LDTate, Happy new Year!!! I ran the OTL and here is the log.

All processes killed

========== OTL ==========

========== COMMANDS ==========

[EMPTYFLASH]

User: Administrator

->Flash cache emptied: 348 bytes

User: All Users

User: Default User

User: LocalService

->Flash cache emptied: 13287 bytes

User: NetworkService

->Flash cache emptied: 13542 bytes

User: Sonia Evans

->Flash cache emptied: 3805511 bytes

Total Flash Files Cleaned = 4.00 mb

[EMPTYTEMP]

User: Administrator

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 129429 bytes

->FireFox cache emptied: 14506790 bytes

->Flash cache emptied: 0 bytes

User: All Users

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: LocalService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

->Flash cache emptied: 0 bytes

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

->Flash cache emptied: 0 bytes

User: Sonia Evans

->Temp folder emptied: 3856359 bytes

->Temporary Internet Files folder emptied: 51931318 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 135707675 bytes

->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 1138887 bytes

%systemroot%\System32 .tmp files removed: 1132049 bytes

%systemroot%\System32\dllcache .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 124 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 47366 bytes

RecycleBin emptied: 421387617 bytes

Total Files Cleaned = 601.00 mb

C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

OTL by OldTimer - Version 3.2.31.0 log created on 01022012_140045

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

December 29, 2011

Sorry I haven't made it back to the "sick" computer yet. Holidays almost over.

December 20, 2011

will be off this computer for a few days....

December 19, 2011

LDTate, UPDATE, my USB is being hijacked real bad this morning. I am keep having to plug and unplug the mouse keyboard to reactive....... sigh

December 19, 2011

LDTate, Well this morning the desktop screen is still running correctly with the screen slow scroll not happening. I am still not sure about what script I turned off by stopping "script running after user logon"?!

My key board is still doing something weird as I am typing this it has got stuck typing one letter a couple of times that looking like the following single letter jjjjjjjjjjjjjjjjjjjjj It is not happening on any particular letter though but there seems to still be something still affecting the USB bus?!

On startup, I am still loosing my USB bus and cannot get into F8 commands for safemode as I still cannot use arrow up or down except on ps2 keyboard. I also still do not have a cdrom. My cdrom is less than 6 months old so if it died during this then the timing is crazy. I have deleted the cddriver to let it just reinstal, but it always says the driver is installed but cannot find the hardware. The bios can see it as I checked just to make sure it was being recognized.

I have been watching my services for extreme memory or cpu usage and that seems normal even when my USB is acting crazy. That used to time with the svchost.exe going crazy. I did have to reinstall Firefox, but I believe the problem was caused by deleting something in the mozilla profile that kept showing up on some of these scans.

December 19, 2011

LDTate, I also noticed in my registry that I have a bunch of repeated entries of the same exact file. Some are exactly the same in content and other are a varient but with the same content in the subfolders that they have in common. These files are located at HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}

wow, my system just lost usb and so I have to finish this with the ps2 keyboard...... How many entries of that file should there be?

December 19, 2011

Here is the EXTRAS.txt

OTL Extras logfile created on: 12/18/2011 9:39:46 PM - Run 1

OTL by OldTimer - Version 3.2.31.0 Folder = C:\Internet Downloads

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

703.48 Mb Total Physical Memory | 461.37 Mb Available Physical Memory | 65.58% Memory free

2.71 Gb Paging File | 2.45 Gb Available in Paging File | 90.42% Paging File free

Paging file location(s): C:\pagefile.sys 0 0E:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 149.05 Gb Total Space | 95.43 Gb Free Space | 64.02% Space Free | Partition Type: NTFS

Drive E: | 74.52 Gb Total Space | 18.17 Gb Free Space | 24.39% Space Free | Partition Type: NTFS

Computer Name: HIGHLANDER | User Name: Wyatt Evans | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

.html [@ = Reg Error: Value error.] -- Reg Error: Key error. File not found

.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

exefile [open] -- "%1" %*

htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office\msohtmed.exe" %1 (Microsoft Corporation)

https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)

InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 0

"AntiVirusOverride" = 0

"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

"DisableMonitoring" = 1

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]

"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]

"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]

"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DoNotAllowExceptions" = 0

"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Program Files\AVG\AVG2012\avgmfapx.exe" = C:\Program Files\AVG\AVG2012\avgmfapx.exe:*:Enabled:AVG Installer -- (AVG Technologies CZ, s.r.o.)

"C:\Program Files\AVG\AVG2012\avgnsx.exe" = C:\Program Files\AVG\AVG2012\avgnsx.exe:*:Enabled:Online Shield -- (AVG Technologies CZ, s.r.o.)

"C:\Program Files\AVG\AVG2012\avgdiagex.exe" = C:\Program Files\AVG\AVG2012\avgdiagex.exe:*:Enabled:AVG Diagnostics 2012 -- (AVG Technologies CZ, s.r.o.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{00000409-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Premium

"{0D00BDA8-A387-4239-8C33-04FA7F37D655}" = Nitrous Log

"{1696C54E-599A-4BA2-9941-BB70C4727887}" = Xtranormal State - Voicepack-English-UK-Daniel

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{2567B22D-4CAC-44ED-8B31-FB92636E2E0F}" = WebCam

"{2DBE41DD-2129-4C65-A3D3-5647236A60F3}" = Quicken 2005

"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{467A3BF8-4C87-4E68-835C-CE5318C157C2}" = Xtranormal State - Voicepack-English-US-Tom

"{4E74D41C-5864-4561-9F6B-069372513A0B}" = AVG 2012

"{50316C0A-CC2A-460A-9EA5-F486E54AC17D}_is1" = AVG PC Tuneup 2011

"{61262D82-A4B7-4B9E-B697-E220D632CCD2}_is1" = Power Commander 5 Software V1.0.1

"{64A50049-407F-4361-9823-CE0C5630504F}" = Ultimate Racer 3.0

"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

"{837006C4-83B7-4BF9-ABC7-AD262FBBFCDF}" = YOSHIMURA Engine Management Professional

"{838A22DF-81CA-4452-9BDD-A1745224D960}" = Xtranormal State - Voicepack-English-UK-Serena

"{898E3215-89AB-485C-B020-AC59229D2C25}" = PC Link Nitrous

"{8E75E6F4-35DF-43E6-8A11-C73437FA3C5B}" = Xtranormal State

"{912536C4-273C-416F-B42C-BBC5B72114D7}" = Xtranormal State - Voicepack-English-US-Samantha

"{929A7FF6-5C3B-45AC-A4C9-30A3AE16CF4B}" = Xtranormal State - Showpak-Playgoz-Preview

"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting

"{97AA0C55-AFAD-4126-B21C-F1318FB6DADA}" = RTLSetup

"{A0BA5AAC-CA61-4C71-9A29-FDF521296225}" = Xtranormal State - SoundPack-Starter Kit

"{A17EABB6-D0C6-44E5-820C-72DC7F495064}" = PaperPort

"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2

"{A436B59A-756E-426F-A348-2BE1BE99B86F}" = AVG 2012

"{AC76BA86-7AD7-1033-7B44-A71000000002}" = Adobe Reader 7.1.0

"{B2586CA8-0F12-11D3-8258-00C04F6843FE}" = Microsoft Office 2000 Web Archive Add-On

"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy

"{B4E03835-FB8B-458A-A1FB-8CDE5424BE66}" = Sid Meier's Civilization 4

"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2

"{C72C8671-4FE0-44D9-8A7B-D07F411D2565}" = WEGO Log

"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1

"{CFBCE791-2D53-4FCE-B3FB-D6E01F4112E8}" = Sid Meier's Civilization 4

"{D83BD5E2-5AF4-49F6-B5C1-484A9760E73D}" = Brother MFL-Pro Suite

"{E59219D4-23B8-11D3-A179-00C04F6C9FA4}" = Microsoft Word Supplemental Templates and Wizards

"{E8DF0C63-3669-4A71-9000-03775FF51D2C}" = RemotePlayback

"{FC053571-8507-44E4-8B6D-AACEAB8CA57C}" = Sansa Media Converter

"{FE9C7463-77A6-4B64-8891-550B7E3505F2}" = Engine Analyzer Pro v3.3

"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin

"Adobe Shockwave Player" = Adobe Shockwave Player

"AnyDVD" = AnyDVD

"AVG" = AVG 2012

"C-Media Audio Driver" = C-Media WDM Audio Driver

"Collectorz.com Movie Collector" = Collectorz.com Movie Collector

"DriverGuide DriverScan" = DriverGuide DriverScan

"DVD Shrink_is1" = DVD Shrink 3.2

"ESET Online Scanner" = ESET Online Scanner v3

"ImgBurn" = ImgBurn

"InstallShield_{2DBE41DD-2129-4C65-A3D3-5647236A60F3}" = Quicken 2005

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.2.1300

"MediaMonkey_is1" = MediaMonkey 2.5

"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1

"Mozilla Firefox 8.0.1 (x86 en-US)" = Mozilla Firefox 8.0.1 (x86 en-US)

"Nero - Burning Rom!UninstallKey" = Nero OEM

"PC Camera Capture" = PC Camera Capture

"Power Commander 3" = Power Commander 3

"Punch! 5 in 1 Home Design" = Punch! 5 in 1 Home Design

"QuickTime" = QuickTime

"S3" = KM400/KN400 Display Driver and Utilities

"Slotman_is1" = Slotman

"UltraDefrag" = Ultra Defragmenter

"VTDisplay" = S3 S3Display

"VTGamma2" = S3 S3Gamma2

"VTInfo2" = S3 S3Info2

"VTOverlay" = S3 S3Overlay

"WIC" = Windows Imaging Component

"Windows Media Format Runtime" = Windows Media Format Runtime

"Windows Script" = Microsoft Windows Script 5.7

"Windows XP Service Pack" = Windows XP Service Pack 3

"WinRAR archiver" = WinRAR archiver

"Xfire" = Xfire (remove only)

"Yahoo! Messenger" = Yahoo! Messenger

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"0683c2c1208fabf1" = Hayabusa ECUeditor for K2-K7, K8- models

========== Last 10 Event Log Errors ==========

[ Application Events ]

Error - 12/18/2011 12:10:59 PM | Computer Name = HIGHLANDER | Source = EventSystem | ID = 4609

Description = The COM+ Event System detected a bad return code during its internal

processing. HRESULT was 80070422 from line 44 of f:\xpsp3\com\com1x\src\events\tier1\eventsystemobj.cpp.

Please contact Microsoft Product Support Services to report this erro

Error - 12/18/2011 12:11:00 PM | Computer Name = HIGHLANDER | Source = VSS | ID = 8193

Description = Volume Shadow Copy Service error: Unexpected error calling routine

CoCreateInstance. hr = 0x80040206.

Error - 12/18/2011 12:11:06 PM | Computer Name = HIGHLANDER | Source = SecurityCenter | ID = 1802

Description = The Windows Security Center Service was unable to establish event

queries with WMI to monitor third party AntiVirus and Firewall.

Error - 12/18/2011 12:11:06 PM | Computer Name = HIGHLANDER | Source = Userenv | ID = 1090

Description = Windows couldn't log the RSoP (Resultant Set of Policies) session

status. An attempt to connect to WMI failed. No more RSoP logging will be done for

this application of policy.

Error - 12/18/2011 12:11:06 PM | Computer Name = HIGHLANDER | Source = Userenv | ID = 1090

Description = Windows couldn't log the RSoP (Resultant Set of Policies) session

status. An attempt to connect to WMI failed. No more RSoP logging will be done for

this application of policy.

Error - 12/18/2011 12:17:45 PM | Computer Name = HIGHLANDER | Source = EventSystem | ID = 4609

Description = The COM+ Event System detected a bad return code during its internal

processing. HRESULT was 80070422 from line 44 of f:\xpsp3\com\com1x\src\events\tier1\eventsystemobj.cpp.

Please contact Microsoft Product Support Services to report this erro

Error - 12/18/2011 12:17:46 PM | Computer Name = HIGHLANDER | Source = VSS | ID = 8193

Description = Volume Shadow Copy Service error: Unexpected error calling routine

CoCreateInstance. hr = 0x80040206.

Error - 12/18/2011 12:17:54 PM | Computer Name = HIGHLANDER | Source = SecurityCenter | ID = 1802

Description = The Windows Security Center Service was unable to establish event

queries with WMI to monitor third party AntiVirus and Firewall.

Error - 12/18/2011 12:17:54 PM | Computer Name = HIGHLANDER | Source = Userenv | ID = 1090

Description = Windows couldn't log the RSoP (Resultant Set of Policies) session

status. An attempt to connect to WMI failed. No more RSoP logging will be done for

this application of policy.

Error - 12/18/2011 12:17:54 PM | Computer Name = HIGHLANDER | Source = Userenv | ID = 1090

Description = Windows couldn't log the RSoP (Resultant Set of Policies) session

status. An attempt to connect to WMI failed. No more RSoP logging will be done for

this application of policy.

[ System Events ]

Error - 12/18/2011 11:15:08 AM | Computer Name = HIGHLANDER | Source = Service Control Manager | ID = 7001

Description = The System Event Notification service depends on the COM+ Event System

service which failed to start because of the following error: %%1058

Error - 12/18/2011 11:48:58 AM | Computer Name = HIGHLANDER | Source = NETLOGON | ID = 3095

Description = This computer is configured as a member of a workgroup, not as a member

of a domain. The Netlogon service does not need to run in this configuration.

Error - 12/18/2011 11:49:08 AM | Computer Name = HIGHLANDER | Source = DCOM | ID = 10005

Description = DCOM got error "%1058" attempting to start the service EventSystem

with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 12/18/2011 11:50:19 AM | Computer Name = HIGHLANDER | Source = Service Control Manager | ID = 7001

Description = The System Event Notification service depends on the COM+ Event System

service which failed to start because of the following error: %%1058

Error - 12/18/2011 12:10:47 PM | Computer Name = HIGHLANDER | Source = NETLOGON | ID = 3095

Description = This computer is configured as a member of a workgroup, not as a member

of a domain. The Netlogon service does not need to run in this configuration.

Error - 12/18/2011 12:10:59 PM | Computer Name = HIGHLANDER | Source = DCOM | ID = 10005

Description = DCOM got error "%1058" attempting to start the service EventSystem

with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 12/18/2011 12:12:11 PM | Computer Name = HIGHLANDER | Source = Service Control Manager | ID = 7001

Description = The System Event Notification service depends on the COM+ Event System

service which failed to start because of the following error: %%1058

Error - 12/18/2011 12:17:35 PM | Computer Name = HIGHLANDER | Source = NETLOGON | ID = 3095

Description = This computer is configured as a member of a workgroup, not as a member

of a domain. The Netlogon service does not need to run in this configuration.

Error - 12/18/2011 12:17:45 PM | Computer Name = HIGHLANDER | Source = DCOM | ID = 10005

Description = DCOM got error "%1058" attempting to start the service EventSystem

with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 12/18/2011 12:18:56 PM | Computer Name = HIGHLANDER | Source = Service Control Manager | ID = 7001

Description = The System Event Notification service depends on the COM+ Event System

service which failed to start because of the following error: %%1058

< End of report >

December 19, 2011

LDTate, before I ran this latest scan I went into gpedit.msc and turned off "run scripts after logon" or something like that and it stop the desktop pic slow scroll and it stop the slow scroll on application shut downs.... so to me that means there is some script associated with my profile that is trying to run with everystartup and then periodically until it crashes a svcprocess. Here is the scan results of OLT

OTL logfile created on: 12/18/2011 9:39:46 PM - Run 1