Thanks, that doesn't look bad. It's common to clean up unused security descriptors and then fix the volume bitmap.
I don't think the check disk repair will have any effect on the issue. If there were other errors reported, possibly, but that was just house keeping on the disk.
When you get the chance, go ahead and try the suggestions re: Norton or WLM options. Then it's a waiting game.
Bill
.
I have it set to notify me of any read receipts. I very rarely have a read receipt requested and never from any of these junk messages.
Your other screen shot shows Send Message Immediately unchecked. Did you mean to uncheck Include Message In Reply? I think so based on your paragraph which followed - "(don't include original msg, and don't reply in the original format)"
I really don't want to do that. We rely on those when sending replies back & forth as it keeps the whole conversation. I'll try changing the plain text settings.
With the infrequency of the crash, I'll just have to run this way for a week or so.
My problem just took a very bizarre turn. My wife was using IE11 to go out to an insurance company website. She clicked on a 'mailto:' link to send an email to the company. This is something I never do so I didn't know there was a problem. I had to force a shutdown of the PC to recover.
I then tried it on my Win7 laptop and it worked as expected - click on a 'mailto:' link from any webpage and an new WLM message opens with the email address populated on the To: line.
Since I got a message that the email client (WLM) was not properly installed, I think I may be at the point of having to uninstall/reinstall Windows Live Essentials.
The problem is so strange, I made a video of it and uploaded it to OneDrive. Here's the link:
https://onedrive.live.com/redir.aspx...ive&Bsrc=Share
You may have to either let the video buffer or download it. When I played it online, the audio stuttered.
My wife is back on the PC with the insurance company on the phone navigating their website.
I'll take a look at the video.
This is odd ... wlarp (repair WLM) didn't fix anything when you ran it as I recall (control panel -> WLM repair).
mailto: is a standard protocol.
Take a look at Control Panel -> Default programs, file associations.
Files are listed first, so scroll down to the bottom and see what application is set for the MAILTO protocol.
Let me know what protocols are associated with WLM.
I'm not suggesting any change - just look. I'm on Win10 right now so I'll have to wait until the download finishes to switch back to Win7 (it might take a while ... it's a 2 GB download).
Also see if WLM is the default mail handler. You might be right .., a reinstall might be the best route to go.
Another option is setting up a new user and trying the same mailto: on the insurance page. That will tell you if it's WLM or a user profile issue.
I'll get back after looking at the video.
Before you reinstall, it is probably advisable to check the system using a wide range of scanners. This is an excellent guide: How to easily clean an infected computer (Malware Removal Guide)
I suggest skipping Step 5-RogueKiller only because some users have reported issues on their machines.
I would add Old Timer-Temp File Cleaner to the list as the first tool.
Download from BleepingComputer
It's important to follow the instructions on when to reboot and when not to reboot. In general the only time you don't want to reboot is after running Rkill.
Most of these scanners run quickly, others (Eset online scanner) can run for a few hours. Plan to run through the guide in one session.
Doing the scans in the guide will almost guarantee that the issue does not crop back up after you decide that a WLM reinstall is the way to go. If there is malware on the system and it is related to the issue, reinstalling WLM won't help by itself.
Some scanners give you the option to decide to clean what was detected - if you know something should not be cleaned, uncheck it - otherwise clean everything else.
After running through the full guide, check the integrity of your system files:
Please follow the instructions in OPTION TWO of SFC /SCANNOW Command - System File Checker
Copy C:\Windows\Logs\CBS\CBS.log to your Desktop (it is a protected file so you cannot attach the original)
Attach the copy of the entire CBS.log to a new post.
Thanks,
Bill
.
I don't see MAILTO listed. I checked my Win7 laptop and it does show up there. Something is very wrong with this desktop.
WLM is set as the default mail handler:
I'll have to look into the other scanners when I have more time & my wife doesn't need the PC.
Thanks,
Gary
I took several hours this afternoon & evening to run the scans you requested. Here are the details, but basically, it's clean. I did skip step #5 as you recommended.
Temp File Cleaner:
I ran a couple scans not listed - Norton Internet Security:
and Super Anti-Spyware:
TDSSKiller:
RKill (the hosts file entries are because I run the MVPS Hosts file):
MBAM:Code:Rkill 2.6.8 by Lawrence Abrams (Grinler) Bleeping Computer - Technical Support and Computer Help Copyright 2008-2014 BleepingComputer.com More Information about Rkill can be found at this link: RKill - What it does and What it Doesn't - A brief introduction to the program - Anti-Virus and Anti-Malware Software Program started at: 10/22/2014 04:41:05 PM in x64 mode. Windows Version: Windows 7 Professional Service Pack 1 Checking for Windows services to stop: * No malware services found to stop. Checking for processes to terminate: * No malware processes found to kill. Checking Registry for malware related settings: * No issues found in the Registry. Resetting .EXE, .COM, & .BAT associations in the Windows Registry. Performing miscellaneous checks: * Windows Defender Disabled [HKLM\SOFTWARE\Microsoft\Windows Defender] "DisableAntiSpyware" = dword:00000001 Checking Windows Service Integrity: * Windows Defender (WinDefend) is not Running. Startup Type set to: Manual Searching for Missing Digital Signatures: * C:\Windows\System32\drivers\usbuhci.sys : 30,720 : 04/04/2014 01:38 AM : a83d0ec9ae4c31704442099d40ba2471 [NoSig] +-> C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_neutral_d5d6e7e900318837\usbuhci.sys : 30,720 : 11/26/2013 09:41 PM : dd253afc3bc6cba412342de60c3647f3 [Pos Repl] +-> C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_neutral_f935002f367d5bb0\usbuhci.sys : 30,720 : 07/13/2009 08:06 PM : 81fb2216d3a60d1284455d511797db3d [Pos Repl] +-> C:\Windows\winsxs\amd64_usbport.inf_31bf3856ad364e35_6.1.7601.17514_none_1be864e21a2d2b97\usbuhci.sys : 30,720 : 07/13/2009 08:06 PM : 81fb2216d3a60d1284455d511797db3d [Pos Repl] +-> C:\Windows\winsxs\amd64_usbport.inf_31bf3856ad364e35_6.1.7601.18328_none_1be17b8a1a31cc37\usbuhci.sys : 30,720 : 11/26/2013 09:41 PM : dd253afc3bc6cba412342de60c3647f3 [Pos Repl] +-> C:\Windows\winsxs\amd64_usbport.inf_31bf3856ad364e35_6.1.7601.22526_none_1c6919a73351367a\usbuhci.sys : 30,720 : 11/26/2013 09:42 PM : 2e682dce4319a90e02a327f8a427544a [Pos Repl] Checking HOSTS File: * Cannot edit the HOSTS file. * Permissions Fixed. Administrators can now edit the HOSTS file. * HOSTS file entries found: 127.0.0.1 localhost ::1 localhost #[IPv6] 0.0.0.0 fr.a2dfp.net 0.0.0.0 m.fr.a2dfp.net 0.0.0.0 mfr.a2dfp.net 0.0.0.0 ad.a8.net 0.0.0.0 asy.a8ww.net 0.0.0.0 static.a-ads.com 0.0.0.0 abcstats.com 0.0.0.0 ad4.abradio.cz 0.0.0.0 a.abv.bg 0.0.0.0 adserver.abv.bg 0.0.0.0 adv.abv.bg 0.0.0.0 bimg.abv.bg 0.0.0.0 ca.abv.bg 0.0.0.0 www2.a-counter.kiev.ua 0.0.0.0 track.acclaimnetwork.com 0.0.0.0 accuserveadsystem.com 0.0.0.0 www.accuserveadsystem.com 0.0.0.0 achmedia.com 20 out of 13714 HOSTS entries shown. Please review HOSTS file for further entries. Program finished at: 10/22/2014 04:41:13 PM Execution time: 0 hours(s), 0 minute(s), and 7 seconds(s)
Hitman Pro (Systweak is installed as part of PC Wizard --> PC-Wizard CPUID - System & hardware benchmark, monitoring, reporting
I left it alone:
AdwCleaner:
JRT:Code:# AdwCleaner v4.001 - Report created 22/10/2014 at 17:09:08 # Updated 20/10/2014 by Xplode # Database : 2014-10-21.1 # Operating System : Windows 7 Professional Service Pack 1 (64 bits) # Username : Gary & Linda - LENOVOM83 # Running from : C:\Users\Gary & Linda\Desktop\adwcleaner_4.001.exe # Option : Scan ***** [ Services ] ***** ***** [ Files / Folders ] ***** Folder Found : C:\Windows\Util ***** [ Scheduled Tasks ] ***** ***** [ Shortcuts ] ***** ***** [ Registry ] ***** Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk Key Found : HKLM\SOFTWARE\systweak Key Found : [x64] HKLM\SOFTWARE\Google\Chrome\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk ***** [ Browsers ] ***** -\\ Internet Explorer v11.0.9600.17344 -\\ Mozilla Firefox v32.0.3 (x86 en-US) ************************* AdwCleaner[R0].txt - [868 octets] - [22/10/2014 17:09:08] ########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [927 octets] ##########
The command window opened and I watched the program run. After a few minutes the command window closed but no log file was displayed as shown on the instructions webpage.
ESET:
Emsisoft:
SFC:Code:Emsisoft Emergency Kit - Version 9.0 Last update: 10/22/2014 6:30:43 PM User account: lenovoM83\Gary & Linda Scan settings: Scan type: Smart Scan Objects: Rootkits, Memory, Traces, C:\Windows\, C:\Program Files\, C:\Program Files (x86)\ Detect PUPs: Off Scan archives: Off ADS Scan: On File extension filter: Off Advanced caching: On Direct disk access: Off Scan start: 10/22/2014 6:31:16 PM Key: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\SYSTWEAK detected: Application.InstallAd (A) Value: HKEY_USERS\S-1-5-21-887747954-3897781091-4292849690-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLETASKMGR detected: Setting.DisableTaskMgr (A) Value: HKEY_USERS\S-1-5-21-887747954-3897781091-4292849690-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLEREGISTRYTOOLS detected: Setting.DisableRegistryTools (A) Scanned 186092 Found 3 Scan end: 10/22/2014 6:52:55 PM Scan time: 0:21:39
CBS log:
While searching around, I found this: Mailto protocol missing
Apparently, when the MAILTO protocol is missing, the result is multiple IE windows opening very rapidly (page 3, last post in the topic above). I'm going to compare the MAILTO registry entries between my laptop and the desktop since the laptop works.
It does beg the question however, if other parts of the WLM install may be corrupted.
+EDIT
Then I found this: Waterfox / Outlook 2003 - clicking a mailto link opens up many IE
I looked at the HKLM\SOFTWARE\Classes\ key and the mailto key is not there at all. I checked the same key on my laptop (where mailto works properly) and found the keys below. It is not identical to the screen shot in the post, but the URL Protocol key is there.
I could try adding the keys, but I am going to wait until I hear back from you. Searches showed that the missing mailto key seems to be a fairly common problem that is unrelated to my original problem of WLM crashing. My concern is why is this key missing, what else could be missing and is it a WLM or Win7 installation problem? I read several posts where reinstalling WLM did not fix this problem. Although, I may still have to reinstall WLM for my original crashing problem.
Anticipating your next question, no, I do not use Registry cleaner programs.
Last edited by nikki605; 23 Oct 2014 at 18:04. Reason: Additional Info
Wow! You're really good, thanks for running all the scans (plus some) and posting all of the information.
The system is squeaky clean. Why the MAILTO: protocol is missing is beyond me. MAILTO is a base protocol of Windows, any number of things could make it go away (malware, incomplete install or shoddy repair, some over protective third party utility). The forensics of finding out why it's gone is beyond the scope of my time spent troubleshooting.
How to fix that one piece of the puzzle is easy.
Before fixing MAILTO, see how your WLM associations compare to mine (or your laptop - sot the list by current default to make it easy)WLMfileprotocol association:
WLMprotocolfile association:
If MAILTO is the only thing that is missing, then use the registry file from this thread:
Post #4: Mailto protocol missing
Right click the downloaded file, select properties and click the Unblock button if present.
Dbl click or right click->merge the reg file to import it to the registry. Answer yes to UAC and merge warning dialogs.
That should set everything up for MAILTO, but please check the associations and default pgms after merging the registry file.
I'd also like you to
1) reset IE proxy settings:
How to reset your Internet Explorer proxy settings.
2) Uninstall Adblock plus (not sure if you already did that)
3) reset your Hosts file
See the Let me fixit it myself for information on how to make a copy of the existing hosts file. Once you have a copy you can just run the MS Fixit.
How can I reset the Hosts file back to the default?
Thanks,
Bill
.
Last edited by Slartybart; 24 Oct 2014 at 12:58. Reason: wrong labels on images
The .vcf file association is missing on the desktop, but is present on my laptop (matches yours exactly).
There are no WLM Protocol associations on the desktop at all, and only one on the laptop - MAILTO.
Since mailto was NOT the only thing missing, I stopped at that point in your posted instructions.
+EDIT
I have not uninstalled Adblock Plus and here is why. I suspect that the Adblock Plus error occurred only because of the rapidly opening IE windows. As a test yesterday, I started IE11 with no addons. I went to the same webpage as in the video and clicked on the mailto link. I got the same message that the email client was not properly installed. As soon as soon as I clicked on OK in that message box, the IE11 windows again started opening rapidly but of course there was no Adblock Plus loaded to crash this time so I didn't get that message.
If we can fix the mailto Registry entries so that mailto works properly, then I should no longer get the rapidly opening IE windows which in turn should no longer cause Adblock Plus to crash. We'll have to wait & see.
In my opinion, this mailto problem is unrelated to my original problem of WLM crashing. It's a side issue that has just distracted us from my original problem. Or, do you think it is related?
Last edited by nikki605; 24 Oct 2014 at 11:25. Reason: Add Adblock Plus Info
Quote
