Bridget

Thanks Seth, Done that, and then a re start and guess what the 'tree' still looks as it did before. but my user name did change in the administrator account. Bridget

User accounts, No that just lets me alter my current ,live account, this is one I did by accident when I first used the machine . When I select open tree' it comes up with control panel\user accounts C:\Users C:\Users\ my password\Documents\ Current Project (e symbol) Manage Accounts C:\Users C:\Users\ my password\Documents\ Tablet installation files The rest are OK just those two items above which include my password. Bridget

Hello all, When I got my new Laptop in December I promptly set about installing passwords and somehow managed to put my favourite password somewhere where it has since been in full view as a user account holder, I have changed my loggon password to another but the old one still comes up as a different user account. Is there anywhere I can edit it out? I do like to use this one. I have looked in all the usual places but cant't get into it and I'm scared to delete it in regedit in case I delete something else. Thanks in advance. Bridget

Bridget here, by the way, I'm a Scottish lady with an Irish name ( My mum). Well you solved it folks. the intruder was as follows (MPEG2Thumbnail Class Yes Thumbnail CyberLink Thumbnail extractor 2.0.0.1914 Cinema CyberLink Corp. No No No C:\Program Files\HP\DVDPlay\Kernel\Video\CLMedia.dll {301AD7DC-ADDD-427f-9660-88A1062689A7} 27/10/2006 03:02:34 08/12/2006 17:49:31 No .dat, .M1S, .m1v, .M2V, .mpe, .mpeg, .mpg, .VOB, .VRO A 57,344) I have disabled it and everything else works. Is there anything else I should do.? Back tonight . (uk time)..bye

Bridget again, yes I did get and remove the Norton remnants thanks , and I think I checke d the tech file, but I'll follow up the latest suggestions and let you know. I'll be back!! have the shell ext looker upper and the windows techfile, thanks a lot I'll let you know.......

It is always when I go into 'my computer' and select c:, it opens, and when the first folder changes to an Icon or bmp view of windows directory , the error screen comes up and it forlds . Bridget

bridget back again, Haven't solved it . but think I know what is causing explorer to crash when I look at the C:\ drive. It's apparantly part of the XP Service pack2. and is called Data Execution Prevention. I wont say where it lives as I guess you moderators wouldn't want the average punter in there. However I have used some of the options availabe, but find it is still skittish. there is quite a lot about it on the Microsoft site. I found it by accident when I wanted to move some mpeg files to another folder it actually,appologised but closed the window I was working in down . (In the interests of securitY ? who says there isn't a little man in there?) also the pause on start up , I sorted when I found boot.ini. the computer had added an extra line to the file, in case I didn't know how to press F8 I guess. I think that file had a different name once apon a time. Any way I can access the file structure in other ways if I really want to, I don't think there are any bugs or viruses about. This is a great forum, and finding answers isn't easy, there are so many variables. Thanks to Seth and Wolfy? bye for now. Bridget

Well I got the jpeg into photobucket, and I did get rid of the norton remnants, thanks but I am lost as to how I get the picture from there to you as there isnt a copy and paste option on photobucket, or here. I am a 66 year old granny you know!!! Also did all the MSconfig things without any joy, it still crashes and wont let me explore in explorer. One new thing has occurred, the system pauses on bootup at the choose which system to start, windows media centre or Windows recovery, then moves on to start up. i think maybe I have bothered you guys too much, and I will understand if you wish to ' toss in the towel'. it's a real Sod of a problem. but i Expect I can live with it, many, may thanks. Bridget

I'll do that Seth , and regarding when I noticed that it crashes just as the folder view changes to Icon view with the first (windows) icon, and I did a screen shot and saved it as a .jpg. which I will send if you tell me how. Bye.and thanks again.... bridget

hi Seth, Did everything as you described don't know what the .gif file is but Ht deleted it after I had checked the item as instructed , downloaded and updated the super anti spam prog ,log file follows. Incidentally I tried explorer again and it still crashes but I noticed that it does it just as the folder view changes to Icon view with the first (windows) icon, and I did a screen shot and saved it as a .jpg.which I will send if you tell me how. Bye.and thanks again.... bridget SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 01/14/2008 at 10:46 AM Application Version : 3.9.1008 Core Rules Database Version : 3379 Trace Rules Database Version: 1373 Scan type : Complete Scan Total Scan Time : 00:39:37 Memory items scanned : 484 Memory threats detected : 0 Registry items scanned : 8015 Registry threats detected : 0 File items scanned : 48356 File threats detected : 18 Adware.Tracking Cookie C:\Documents and Settings\Compaq_Administrator\Cookies\compaq_administrator@server.lon.liveperson[3].txt C:\Documents and Settings\Compaq_Administrator\Cookies\compaq_administrator@h.starware[2].txt C:\Documents and Settings\Compaq_Administrator\Cookies\compaq_administrator@adopt.euroclick[2].txt C:\Documents and Settings\Compaq_Administrator\Cookies\compaq_administrator@burstnet[2].txt C:\Documents and Settings\Compaq_Administrator\Cookies\compaq_administrator@tribalfusion[2].txt C:\Documents and Settings\Compaq_Administrator\Cookies\compaq_administrator@1069959687[1].txt C:\Documents and Settings\Compaq_Administrator\Cookies\compaq_administrator@click-now[1].txt C:\Documents and Settings\Compaq_Administrator\Cookies\compaq_administrator@doubleclick[2].txt C:\Documents and Settings\Compaq_Administrator\Cookies\compaq_administrator@richmedia.yahoo[1].txt C:\Documents and Settings\Compaq_Administrator\Cookies\compaq_administrator@www.googleadservices[1].txt C:\Documents and Settings\Compaq_Administrator\Cookies\compaq_administrator@server.lon.liveperson[1].txt C:\Documents and Settings\Compaq_Administrator\Cookies\compaq_administrator@imrworldwide[2].txt C:\Documents and Settings\Compaq_Administrator\Cookies\compaq_administrator@www.googleadservices[4].txt C:\Documents and Settings\Compaq_Administrator\Cookies\compaq_administrator@mediaplex[1].txt C:\Documents and Settings\Compaq_Administrator\Cookies\compaq_administrator@www.googleadservices[2].txt C:\Documents and Settings\Compaq_Administrator\Cookies\compaq_administrator@try.starware[1].txt C:\Documents and Settings\Compaq_Administrator\Cookies\compaq_administrator@atdmt[2].txt C:\Documents and Settings\Compaq_Administrator\Cookies\compaq_administrator@statse.webtrendslive[2].txt

Hi Seth, I got the hijack this log. which i'll stick on the end of this. I also did the safe mode access to Explorer and had no problems whatsoever. Herewith hijack log. Many thanks. Bridget Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:34:27, on 13/01/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\ehome\ehtray.exe C:\WINDOWS\RTHDCPL.EXE C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Visage\PDF Printer\vspdfprsrv.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 My Custom Edition\CalCheck.exe C:\PROGRA~1\Yahoo!\browser\ycommon.exe C:\WINDOWS\arservice.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Kodak\printer\center\KodakSvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Common Files\Protexis\License Service\PSIService.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\Tablet.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\eHome\ehmsas.exe C:\WINDOWS\System32\svchost.exe C:\HP\KBD\KBD.EXE c:\windows\system\hpsysdrv.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=64&bd=PRESARIO&pf=desktop R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_GB&c=64&bd=PRESARIO&pf=desktop R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/sb/*http://uk.docs.yahoo.com/info/bt_side.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=64&bd=PRESARIO&pf=desktop R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Lexico Toolbar - {11359F4A-B191-42d7-905A-594F8CF0387B} - C:\WINDOWS\Downloaded Program Files\CONFLICT.1\lexbar.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - (no file) O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O3 - Toolbar: Dictionary.com - {11359F4A-B191-42D7-905A-594F8CF0387B} - C:\WINDOWS\Downloaded Program Files\CONFLICT.1\lexbar.dll O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [vspdfprsrv.exe] C:\Program Files\Visage\PDF Printer\vspdfprsrv.exe --background O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg O4 - HKLM\..\Run: [iSUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user') O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user') O4 - .DEFAULT User Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'Default user') O4 - Global Startup: Ulead Photo Express Calendar Checker For My Custom Edition.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 My Custom Edition\CalCheck.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Search &Dictionary - C:\Program files\Lexico\Toolbar\dictionary.htm O8 - Extra context menu item: Search &Thesaurus - C:\Program files\Lexico\Toolbar\thesaurus.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: BT Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file://C:\Program Files\Agatha Christie\Images\stg_drm.ocx O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper2007261.dll O16 - DPF: {C45B1500-7B63-47C2-AB25-C28CB46AFDEE} (MSN Music Mediabar) - http://sib1.od2.com/common/musicmanager/installation/MusicManagerPlugin.CAB O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - http://help.broadbandassist.com/bbdesktop/PreQual/files/MotivePreQual.cab O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file://C:\Program Files\Bejeweled 2\Images\armhelper.ocx O16 - DPF: {F0E2D69A-DC2F-4E9B-A993-684FB1C21DBC} - http://dictionary.reference.com/tools/toolbar/lexico.cab O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Kodak AiO Device Service (KodakSvc) - Eastman Kodak Company - C:\Program Files\Kodak\printer\center\KodakSvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: ProtexisLicensing - Unknown owner - C:\Program Files\Common Files\Protexis\License Service\PSIService.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/COMPAQ~1/LOCALS~1/Temp/msoclip1/01/clip_image002.gif -- End of file - 10285 bytes

Did the Chkdsk / r and when i came back it had rebooted into windows so I presume it found nothing? would it have told me if it had? You didn't specify / F to fix so think you implied it would tell me. Also the explorer still crashes if I Access the c: directory, so I don't think it can be a Kodak fault, anyway I installed the printer onto my Vista laptop and I can access everything there without any trouble, though I must confess I haven't used the printer from the lap top which may make a difference. The laptop and Vista are very new to me and I am treating both with kid gloves. Cn't think of anything else , except that I removed Magix Audio cleaning lab a few weeks ago, could I have done something wrong then. I only wanted it to transfer an old oudio file to CD. Bridget. PS Sorry I don't understand what is meant by the ( Hijack) instructions at the top, have had a look at the page and I wouldn't know where to start.

Seth, It''s a PC doctor Diagnostic which checks all the hardware, I asked for a hard disk check, and have since made a diagnostice bootable CD, which may help if it all falls down. However I have uninstaled the Kodak Software which incidentally took the printer as well. Managed to put it back on without most of the extras, mostly image editing stuff, and I'll see how I go along. Will let folks know. Bridget

Seth, I'll have to go back and look them up, but I found them on the Help system, they seemed pretty thorough and actually checked the hard disk I think Lineally, Medially etc.. I hope I have that right, about seven checks in all. this was after I had done a scandisk and defrag. 'cos I was a bit worried. bridget,

Wolfemole, I'd like to thank you, I havent checked it out yet, but I did install a new printer recently , and guess what it's a Kodak. Brilliant machine but more complicated than any I've had before. I'll let you know if uninstalling the add ons gets rid of the problems. Many thanks. Bridget