Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Locks up during malware scans


  • Please log in to reply
21 replies to this topic

#1 Hamm

Hamm

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Location:Daytona Beach, Florida
  • Local time:07:07 AM

Posted 10 March 2010 - 08:04 PM

I have been working on a fix for my system lock-ups.
At first I thought maybe my PSU was dieing. The lock-ups did not get worse as I suspected they would, and even became less frequent.
I can get locked when I'm on the web with 5 pages running. But not all the time. I could have no web pages open, but lock-up with just the e-mail running. or with just one web page open. Or i could start the system, log in, walk away, only to come back to find it locked-up. As I am typing this the system is running fine. It never locks up when I am playing Battlefield 2142.
AVG finds nothing when it runs all the way though. Malwarebytes, and SuperAntiSpyware locks up on complete scan in the same file. (C:\Windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\lang\chtskf.dll). Quick scan with same programs only finds tracking cookies. I ran MalWareBytes with rrkill several time to the same lock-up outcome.
Spy-Bot S&D runs all the way though but finds nothing.
I ran Check Disc in repair mode. Ran the System File Checker. and am still having same problem.
When I had enough..I slaved the disc onto another machine and externally scanned with AVG9. Nothing found.
My system :
I built 5 years ago.
AMD Athlon 64 2800+ ASUS K8N Mobo
2.5 Gigs Kingston DDR400 PC3200 RAM
Maxtor Diamond9 80 Gig drive
Original MGE PSU 480 Watts that came with case.
Windows XP Professional Service pack 2
I was hoping someone might have an idea that might help. Thanks Hamm

Edited by boopme, 10 March 2010 - 10:43 PM.


BC AdBot (Login to Remove)

 


#2 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,561 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:06:07 AM

Posted 10 March 2010 - 10:43 PM

Hello , I feel this may be a soft or hardware issue. I am moving this to XP. If they deem it necessary we can come back.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#3 Hamm

Hamm
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Location:Daytona Beach, Florida
  • Local time:07:07 AM

Posted 10 March 2010 - 11:01 PM

Thanks.

#4 hamluis

hamluis

    Moderator


  • Moderator
  • 56,551 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:05:07 AM

Posted 11 March 2010 - 09:02 AM

Hi :thumbsup:.

No error messages?

Have you checked Event Viewer for possible clues?

How To Use Event Viewer - http://www.bleepingcomputer.com/forums/t/40108/how-to-use-event-viewer/

After reviewing the last 5 errors noted in Event Viewer...post the details of each. Details for a line item can be seen by double-clicking on the line item reflecting an error.

We are not interested in warnings or information items.

Louis

#5 Hamm

Hamm
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Location:Daytona Beach, Florida
  • Local time:07:07 AM

Posted 11 March 2010 - 09:45 AM

Here are the last 6 errors from this morning.

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1500
Date: 3/11/2010
Time: 8:31:38 AM
User: NT AUTHORITY\LOCAL SERVICE
Computer: HAMM
Description:
Windows cannot log you on because your profile cannot be loaded. Check that you are connected to the network, or that your network is functioning correctly. If this problem persists, contact your network administrator.

DETAIL - The configuration registry database is corrupt.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1508
Date: 3/11/2010
Time: 8:31:38 AM
User: NT AUTHORITY\SYSTEM
Computer: HAMM
Description:
Windows was unable to load the registry. This is often caused by insufficient memory or insufficient security rights.

DETAIL - The configuration registry database is corrupt. for C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\\UsrClass.dat

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1500
Date: 3/11/2010
Time: 8:31:35 AM
User: NT AUTHORITY\LOCAL SERVICE
Computer: HAMM
Description:
Windows cannot log you on because your profile cannot be loaded. Check that you are connected to the network, or that your network is functioning correctly. If this problem persists, contact your network administrator.

DETAIL - The configuration registry database is corrupt.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1508
Date: 3/11/2010
Time: 8:31:35 AM
User: NT AUTHORITY\SYSTEM
Computer: HAMM
Description:
Windows was unable to load the registry. This is often caused by insufficient memory or insufficient security rights.

DETAIL - The configuration registry database is corrupt. for C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\\UsrClass.dat

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1500
Date: 3/11/2010
Time: 8:31:16 AM
User: NT AUTHORITY\LOCAL SERVICE
Computer: HAMM
Description:
Windows cannot log you on because your profile cannot be loaded. Check that you are connected to the network, or that your network is functioning correctly. If this problem persists, contact your network administrator.

DETAIL - The configuration registry database is corrupt.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1508
Date: 3/11/2010
Time: 8:31:16 AM
User: NT AUTHORITY\SYSTEM
Computer: HAMM
Description:
Windows was unable to load the registry. This is often caused by insufficient memory or insufficient security rights.

DETAIL - The configuration registry database is corrupt. for C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\\UsrClass.dat

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

#6 hamluis

hamluis

    Moderator


  • Moderator
  • 56,551 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:05:07 AM

Posted 11 March 2010 - 10:20 AM

Microsoft says...see http://support.microsoft.com/kb/941339.

Copy Data from a Corrupted User Profile to a New Profile in Windows XP - http://support.microsoft.com/kb/811151

I would try creating a new profile (treating it as damaged/corrupted) and then deleting the old.

If that failed...I'd try the registry edits.

If that failed...repair install of XP.

Louis

#7 Hamm

Hamm
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Location:Daytona Beach, Florida
  • Local time:07:07 AM

Posted 11 March 2010 - 10:45 AM

Thanks for the info Hamluis. Not sure how I got Myself in this situation, but will work to correct it. I thank you much for your help, and that of the forum. You guys rock!

#8 hamluis

hamluis

    Moderator


  • Moderator
  • 56,551 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:05:07 AM

Posted 11 March 2010 - 11:48 AM

Not sure anyone understands exactly how a profile may become damaged...just as (probably) no one understands just how/why/when file damage occurs on a typical system.

It happens...and there are ways to deal with it :thumbsup:.

Louis

#9 Hamm

Hamm
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Location:Daytona Beach, Florida
  • Local time:07:07 AM

Posted 11 March 2010 - 07:46 PM

I followed the directs from Microsoft but no joy. Files have be Unhidden, but not matter what user I use, even administrator, my user files are (Access denied).
What would be involved in the registry edits. would you be able to help with that. or point me in the right direction?

#10 hamluis

hamluis

    Moderator


  • Moderator
  • 56,551 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:05:07 AM

Posted 11 March 2010 - 08:39 PM

<<I followed the directs from Microsoft but no joy.>>

You created a new profile and deleted the old one suspected of being damaged?

<<Files have be Unhidden, but not matter what user I use, even administrator, my user files are (Access denied).>>

There are no files involved in deleting profiles...all you have to do is login...go to Control Panel/User Accounts...and create the new profile and transfer the settings/files from the old profile.

The control to see hidden/system files, http://www.microsoft.com/windowsxp/using/h...iddenfiles.mspx. While changing that, also change

In addition to making the change detailed above...uncheck the next two items (Hide extensions, Hide protected operating system files.

Forget the registry edit, for now.

Louis

#11 Hamm

Hamm
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Location:Daytona Beach, Florida
  • Local time:07:07 AM

Posted 11 March 2010 - 09:28 PM

I created two profiles for a total of three. The one to move files to (HAMM 2). And one in which to work from (ANOTHER). I logged in as ANOTHER in Explorer to move the files from HAMM to HAMM 2, Explorer will not allow access to files in HAMM. It gave me (Access Denied). I even tried logging in as Admin to move files, That did not help.
All have that you are asking unchecked have been unchecked prior to these events. I hope that was not as confusing as it sounds.

Edited by Hamm, 11 March 2010 - 09:31 PM.


#12 hamluis

hamluis

    Moderator


  • Moderator
  • 56,551 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:05:07 AM

Posted 11 March 2010 - 10:37 PM

Explanation appreciated :thumbsup:.

What files are you trying to access?

If you are trying to access My Documents, etc....any of the files listed under Documents & Settings for the initial profile...then you should try Taking Ownership of Files/Folders in Windows XP - http://support.microsoft.com/kb/308421.

Louis

#13 Hamm

Hamm
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Location:Daytona Beach, Florida
  • Local time:07:07 AM

Posted 11 March 2010 - 11:07 PM

Yes that did it Louis. That allowed me access to the files that I need to copy into new user profile. I can't find all of the Ntuser files that I'm not suppose to move. So I will continue to search them out later. Thank you. I will get back as soon as I can. Sleep, Work, More work.

#14 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:11:07 AM

Posted 11 March 2010 - 11:31 PM

ntuser files are per profile basis. You cannot move them around, and why would you?

#15 Hamm

Hamm
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Location:Daytona Beach, Florida
  • Local time:07:07 AM

Posted 12 March 2010 - 05:29 AM

Microsoft says...see http://support.microsoft.com/kb/941339.

Copy Data from a Corrupted User Profile to a New Profile in Windows XP - http://support.microsoft.com/kb/811151

I would try creating a new profile (treating it as damaged/corrupted) and then deleting the old.

If that failed...I'd try the registry edits.

If that failed...repair install of XP.

Louis


The link from Microsoft I was given by Louis explained the process. To create the new user profile I would move Old user files into New profile leaving these files behind.
Ntuser.dat
Ntuser.dat.log
Ntuser.ini

Edited by Hamm, 12 March 2010 - 05:34 AM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users