Re: SYSTEM RESTORE & MACROMEDIA

April

It was a good evening,

I did check Aumha forums to see what was found but I have not found your thread. What was the subject line?

Can we return to your problem with the Command prompt another time?

Can you please provide more information regarding your partitions? How large is each and how much free space on each?

The Error Report yesterday referred to Ask Jeeves but I have no idea why Window Defender had a problem with it!

It would be best to only look at Error Reports generated after you have finished cleaning with HijackThis.


--

Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~


April wrote:
Hi Gerry

Maybe should say Hi Gerry & Bert followed instructions. No pests, etc

Hope you had a nice evening out.

Bert sent yesterday, re AumHa Forums. So far used KillBox have
deleted all critical objects.

Reference to command box it is the one you refer to black background,
white lettering. Now, since I purged last night, Netstat-no is
lost. At least yesterday it popped up and disappeared very quickly,
but at least knew it existed.

275 did nothing

Disk Partition Hard Disk
Local Disk (D:) 1% (Low) More Info
Local Disk (C:) 53% (Low)
Well at the risk of being thick again, NOPE would not move as really
not aware of both, to me only c: exited, never gave D a thought.

Are things going from bad to worst or is it just me thinking this??



These errors/warning appeared this A.M.

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1001
Date: 14/01/2007
Time: 8:30:13 AM
User: N/A
Computer: FAMILY
Description:
Fault bucket 264368171.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 42 75 63 6b 65 74 3a 20 Bucket:
0008: 32 36 34 33 36 38 31 37 26436817
0010: 31 0d 0a 1..

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 14/01/2007
Time: 8:30:02 AM
User: N/A
Computer: FAMILY
Description:
Faulting application LuComServer_3_0.EXE, version 3.0.0.150, faulting
module ntdll.dll, version 5.1.2600.2180, fault address 0x00018fea.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4c 75 43 ure LuC
0018: 6f 6d 53 65 72 76 65 72 omServer
0020: 5f 33 5f 30 2e 45 58 45 _3_0.EXE
0028: 20 33 2e 30 2e 30 2e 31 3.0.0.1
0030: 35 30 20 69 6e 20 6e 74 50 in nt
0038: 64 6c 6c 2e 64 6c 6c 20 dll.dll
0040: 35 2e 31 2e 32 36 30 30 5.1.2600
0048: 2e 32 31 38 30 20 61 74 .2180 at
0050: 20 6f 66 66 73 65 74 20 offset
0058: 30 30 30 31 38 66 65 61 00018fea

Event Type: Error
Event Source: Application Hang
Event Category: (101)
Event ID: 1002
Date: 14/01/2007
Time: 8:28:04 AM
User: N/A
Computer: FAMILY
Description:
Hanging application iexplore.exe, version 7.0.5730.11, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 69 65 78 70 6c 6f iexplo
0018: 72 65 2e 65 78 65 20 37 re.exe 7
0020: 2e 30 2e 35 37 33 30 2e .0.5730.
0028: 31 31 20 69 6e 20 68 75 11 in hu
0030: 6e 67 61 70 70 20 30 2e ngapp 0.
0038: 30 2e 30 2e 30 20 61 74 0.0.0 at
0040: 20 6f 66 66 73 65 74 20 offset
0048: 30 30 30 30 30 30 30 30 00000000

Thank you, have a great day.
April








"Gerry Cornell" wrote:

April


Your version of Adobe Flash is up to date.

How many drives / partitions do you have. Have you been moving
programmes from one partition / drive to another?

"when I try the command prompt as directed the window opens and
closes in a flash is this normal obviously cannot read it." That is
unexpected. It should take you to a command prompt. A screen with a
black background and the prompt should be something like c:\> ( or a
variant of that).

Try option 275 in the attached link:
http://www.kellys-korner-xp.com/xp_tweaks.htm

Once installed you can forget UPH Clean. The only record it should
leave are Information Reports in the Application log in Event Viewer.

The reference to Erunt is red herring. Edward thinks it is an
alternative to System Restore. The tool serves a different purposes.

I haven't got the time now to research the Windows Defender Report
now as I am due to meet friends and don't want to be late.


--

Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~


April wrote:
Hi Gerry

Sorry re thinking we were working on the System Restore issue, I can
be
thick sometimes.

RE RAM: 1GB (1.60GHz, 0.99GB)

RE FLASH: Adobe Flash 9.0.28

? re 4226 error when I try the command prompt as directed the
window
opens
and closes in a flash is this normal obviously cannot read it.

Also the uphclean does this work in the background, so one is not
aware of
it working.

Have you heard of a programme called ERUNT freeware will attach this
was
sent yesterday

snip

While System Restore is a bonus when it 'works' but unfortunately it
cannot
be relied upon and therefore, in my opinion is useless as a 'backup'
for the
Registry. However, ERUNT is freeware and does virtually all that
System
Restore does and is totally reliable. As far as I am concerned,
System
Restore should be 'retired' and ERUNT used in its place.





Checked my Warnings/Errors: todays

Event Type: Warning
Event Source: Tcpip
Event Category: None
Event ID: 4226
Date: 13/01/2007
Time: 11:56:33 AM
User: N/A
Computer: FAMILY
Description:
TCP/IP has reached the security limit imposed on the number of
concurrent
TCP connect attempts.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 01 00 54 00 ......T.
0008: 00 00 00 00 82 10 00 80 ....?..?
0010: 01 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

Event Type: Warning
Event Source: WinDefend
Event Category: None
Event ID: 3004
Date: 13/01/2007
Time: 11:58:17 AM
User: N/A
Computer: FAMILY
Description:
Windows Defender Real-Time Protection agent has detected changes.
Microsoft
recommends you analyze the software that made these changes for
potential
risks. You can use information about how these programs operate to
choose
whether to allow them to run or remove them from your computer.
Allow
changes only if you trust the program or the software publisher.
Windows
Defender can't undo changes that you allow.
For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=74409
Scan ID: {CABAA92F-53AD-4F7B-9EDF-6FA2CBE99225}
User: FAMILY\Lea McGillivray
Name: Unknown
ID:
Severity: Not Yet Classified
Category: Not Yet Classified
Path Found:
clsid:HKLM\SOFTWARE\CLASSES\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA};regkey:HKLM\SOFTWARE\CLASSES\TYPELIB\{07B18EA0-A523-4961-B6BB-170DE4475CCA}\1.0;regkey:HKLM\SOFTWARE\CLASSES\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA};regkey:HKCU@S-1-5-21-2465356760-483536154-3234953282-1005\Software\Microsoft\Internet
Explorer\Toolbar\WebBrowser\\{07B18EA9-A523-4961-B6BB-170DE4475CCA};iewebbrowser:HKCU@S-1-5-21-2465356760-483536154-3234953282-1005\Software\Microsoft\Internet
Explorer\Toolbar\WebBrowser\\{07B18EA9-A523-4961-B6BB-170DE4475CCA};typelibversion:HKLM\SOFTWARE\CLASSES\TYPELIB\{07B18EA0-A523-4961-B6BB-170DE4475CCA}\1.0;typelib:HKLM\SOFTWARE\CLASSES\TYPELIB\{07B18EA0-A523-4961-B6BB-170DE4475CCA};file:C:\Program
Files\MyWebSearch\bar\7.bin\MWSBAR.DLL Alert Type: Unclassified
software Detection Type:

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Thanks, have a great day
April





"Gerry Cornell" wrote:

April

The suggestions I made were not intended to get System Restore to
work. They were to address freezes and to ensure that your Shutdown
does so in good time.

The suggestion regarding Event ID 4226 was one you may need to try
every time the System hangs until you identify what it is that
keeps
trying and failing to connect.
Note the process identification number (PID) of the process in the
PID column being the key. You can then Stop the Process. This may
tell you what is causing the problem because you see a change on
your computer. The minimum is that it should stop the freeze until
the next time. There is a further more involved option using a
programme called Process Explorer, which can be used to pin point
what is using the process. However, be mindful that the PID number
is only used for a single session and will be replaced by another
PID number in the next session. This is only one way to diagnose
what is causing a freeze. There are other ways. Error Reports can
also high a problem.

How much RAM memory does your computer have? Right click on the My
Computer icon on your Desktop to get this information.

What version of Flash do you have? A lot of users are currently
having problems. It seems to to have started from the discovery and
fix for a security vulnerability.

Is System Restore set to monitor all drives? It needs to be set to
only monitor your System drive, usually your C drive. Right click
on
your My Computer icon , select Properties,
System Restore, place the cursor on the drive / partition click on
Settings and click on the box before Turn off System Restore on
this
drive. Repeat the operation for each partition. Click on OK, Apply,
OK and exit. Restart the computer for the change to take effect.
However, I doubt that using System Restore wil be the right move in
your situation.

Have any further Event Viewer Warning / Error Reports appeared?

It has been showers and wind on and off this week. They have
erected
the new temporary flood defences in Bewdley.

--

Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~


April wrote:
Hi Gerry

I hope that I performed your suggestions correctly, but still no
System Restore. I noticed how many others are having the same
problem, at least one with a new computer, it makes one wonder if
this problem is inherent with XP (pro), for so many to be having
the
same difficulty with System Retore. Along with this problem, I
still
cannot stop the pop up error occurring as mentioned in my earlier
e-mail.

Noted your address, how it the winter weather over there? Just
curious born near Birmingham.

Thank you, have a great day
April

"Gerry Cornell" wrote:

April

For Event ID: 4226
Read the link and try the suuggestion in the link. You may need
to
try it when you get the first sign of a system hang. To access
the
Command Prompt select Start, Run, type Cmd and click on OK.

http://www.microsoft.com/technet/support/ee/transform.aspx?ProdName=Windows%20Operating%20System&ProdVer=5.2&EvtID=4226&EvtSrc=Tcpip&LCID=1033

For Event ID: 1517

Download and install the User Profile Hive Cleanup Service
Download details: User Profile Hive Cleanup Service
http://snipurl.com/5b61

UPHClean v1.5e readme.txt
http://snipurl.com/ko8m


--

Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~


April wrote:
Hi Gerry
Pasting what is there for this boot, sure were a lot more
yesterday
since i don't understand following your instructions. Thanks for
your
patience i am learning.
Take Care, have a great day,

application:

Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1517
Date: 10/01/2007
Time: 10:16:49 PM
User: NT AUTHORITY\SYSTEM
Computer: FAMILY
Description:
Windows saved user FAMILY\ registry while an application or
service
was still using the registry during log off. The memory used by
the
user's registry has not been freed. The registry will be
unloaded
when it is no longer in use.

This is often caused by services running as a user account, try
configuring the services to run in either the LocalService or
NetworkService account.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

system:

.

Relevant Pages

  • Re: Possible Sleeping Virus
    ... Remember that System Restore only tracks SYSTEM files - not yours. ... You should periodically defragment your hard drives as well as check them ... using Windows XP "prettifications". ... You should at least turn on the built in firewall. ...
    (microsoft.public.windowsxp.newusers)
  • Re: My Computer Icon
    ... but you might want to look at System Restore. ... How to start the System Restore tool at a command prompt in Windows XP ... I can see all the drives in Explorer,> I just can see anything when I double click on the My Computer icon> on the Desktop. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: My Computer Icon
    ... MS-MVP Windows Shell/User ... but you might want to look at System Restore. ... Missing Drives in My Computer and Windows Explorer ...
    (microsoft.public.windowsxp.security_admin)
  • Re: it takes about 5 minutes to switch directories
    ... but i cannot make the windows installer work by unregistering, ... It is likely that an allocation of 12% has been made to System Restore ... Internet Files, ... Again do it on both drives ignoring the "You do not ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: SYSTEM RESTORE & MACROMEDIA
    ... Sent info re hard drives earlier. ... type: Local Disk ... Event Type: Error ... Sorry re thinking we were working on the System Restore issue, ...
    (microsoft.public.windowsxp.perform_maintain)