contant script error messages due to virus

mike6 · Jun 24, 2012

babylon.exe managed to get on my windows 7 computer. Since then I keep getting script error messages on numerous web pages. I have deleted babylon but think it is still hiding somewhere.
I have followed debugging advice to no avail. I have also restore but am angry that windows 7 prevents me from going back far enough.
Does anyone know if a virus would be responsible and how I can prevent the script errors appearing?
I have followed numerous ideas but nothing is working and wonder if a return to factory settings is the only option left, altho0ugh I dont really want that. Thanks

marsmimar · Jun 24, 2012

Hello Mike and welcome to Seven Forums.

Once a virus infects a machine you can never be 100% certain that a removal tool has gotten rid of all traces. So depending on what removal steps you've already taken, I'd suggest using a free tool from Microsoft called Windows Defender Offline. It will start to scan your machine before Windows boots, which is something that most scanners don't do. They have to wait for Windows to boot before they start to work. Create your media from a machine that's not infected.

http://www.sevenforums.com/tutorials/166445-windows-defender-offline.html

Once you've used WDO I'd then suggest using at least a couple more free on-demand scanners since no anti-malware program is 100% effective 100% of the time. (If there was such a thing we'd all be using it.) Some of the recommended free products are Malwarebytes | ESET | Superantispyware | Hitman Pro.

If your additional scans come back clean I'd next recommend you run a System file Checker scan from an elevated command prompt (option two) to rule out any damaged or corrupt system files. If any problems are noted, run the scan 3 times rebooting in between each scan.

http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

Post back if any of this helped or not. There are other things that can be tried that won't cause you to lose personal data, custom settings, etc. before having to resort to a factory reinstall or a clean install.

mike6 · Jun 24, 2012

thanks

Hi Marc. Thanks for that. I'll post a thread later on to let you know if I have success

njkaruna · Jan 6, 2013

Constant Script Error Messages - marsmimar's suggestions

Hello. I have recently developed many very annoying script error messages when on the web. Nothing I have done has gotten rid of them -- I have tried the usual options in IE9, many malware and virus scans, restores to earlier times, etc.. Stopzilla did quarantine two adware infections.

Marsmimar -- thanks for your suggestions. I did the Windows Defender Offline quick and full scans, and the System File Checker scan. All were clean.

You indicated there were other suggestions to try. Would you share these please?

Thanks.

Jacee · Jan 7, 2013

njkaruna, download AdWareCleaner AdwCleaner Download to your desktop
1.Right-click on adwcleaner.exe and select Run As Administrator to launch the application.
2.Click on Delete button.
3.Confirm each time with OK.
4.Your computer will be rebooted automatically. A text file will open after the restart. Please post the content of that logfile in your reply.
Note: You can find the logfile at C:\AdwCleaner[Sn].txt as well - n is the order number.

njkaruna · Jan 7, 2013

Thank You Jacee

I have done as you suggester Jacee. I had to disable Stopzilla though -- it saw AdwCleaner.exe as a Trojan and quarantined it each time I tried to load it. As a total layperson, it was a bit of a leap of faith to go ahead ....

Here is the log:

# AdwCleaner v2.104 - Logfile created 01/07/2013 at 18:39:07
# Updated 29/12/2012 by Xplode
# Operating system : Windows 7 Professional Service Pack 1 (64 bits)
# User : anne - ANNE-PC
# Boot Mode : Normal
# Running from : \\ANNE-PC\Users\anne\Desktop\AdwCleaner.exe
# Option [Delete]

***** [Services] *****

***** [Files / Folders] *****
Folder Deleted : C:\ProgramData\APN
Folder Deleted : C:\ProgramData\Ask
Folder Deleted : C:\ProgramData\boost_interprocess
***** [Registry] *****
Key Deleted : HKCU\Software\AppDataLow\Software\iWon
Key Deleted : HKCU\Software\DataMngr
Key Deleted : HKCU\Software\DataMngr_Toolbar
Key Deleted : HKCU\Software\ilivid
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Key Deleted : HKLM\Software\Freeze.com
Key Deleted : HKLM\Software\iLividSRTB
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\iLividMediaBar_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\iLividMediaBar_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetup_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetup_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{004EB151-885B-4A9E-A22D-CA98DD998D75}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{041278C7-DF92-486D-AE85-921BDFC75A43}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0F1794F2-900B-4C81-8146-9234E5CC5BE2}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1116A14B-F6A3-4FD9-A00E-FF8CF270EE48}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{21D9997E-5D2A-4737-BCBA-C958C0590295}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{23119123-0854-469D-807A-171568457991}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{36A7148B-639E-423C-90BB-30B6E1A40BD7}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{56965DCF-718F-4148-BECF-5A2B466F4556}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{58E64AEE-516A-4DFC-AC38-31C50E8AF0F1}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5F701D7D-C869-41F0-B0E2-8136F02B539C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{61DAB0AD-AD23-4E40-84AC-7C6CE64D4EB3}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{65D8E17B-312E-4E12-913B-A841A8631143}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6BDA50D2-5597-4C68-A842-9B857FCCDA49}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6CA3D0AB-F807-462C-BA7F-E27F07F91E32}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6F99D2AE-5C90-43C2-A2FE-81DBE512E2FC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{860AF5D1-0735-409D-8E5F-E3E99356D7E9}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8997561D-CF0B-42C7-AAE6-78801B3ADC7F}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{92580E8C-88F5-4551-9D9E-8147E7EE2C32}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A0636D37-97D0-4DC4-95A6-93AABA07437F}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A786F51D-B3C7-4F52-91EF-E1A892C2A2AE}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D244EAC5-A0F5-4859-A1F8-18ABC0AC3A00}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D8AF87C1-0B1E-494B-AAF0-CECC3FFEDF99}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{DAFC4DAE-7794-4E16-9A98-F6001303DCD0}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EAB77009-B974-48DF-8229-E70CFAA11C69}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EBAA6283-B61F-4DDD-9659-56635433A307}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EFB0C189-5077-4340-9838-AF7B8E792A54}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EFB4F034-3EB5-48D5-84DD-89BBCF9A182F}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F9D45087-1CF1-452E-9649-FDFDAC578E03}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FF2EBC1C-6579-41DB-91DD-945A1C8DB2D2}
Key Deleted : HKLM\SOFTWARE\DataMngr
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [10]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [10]
***** [Internet Browsers] *****
-\\ Internet Explorer v9.0.8112.16457
[OK] Registry is clean.
-\\ Google Chrome v23.0.1271.97
File : C:\Users\anne\AppData\Local\Google\Chrome\User Data\Default\Preferences
Deleted [l.14] : homepage = "hxxp://www.searchnu.com/406",
Deleted [l.1557] : homepage = "hxxp://www.searchnu.com/406",
*************************
AdwCleaner[S1].txt - [4788 octets] - [07/01/2013 18:39:07]
########## EOF - C:\AdwCleaner[S1].txt - [4848 octets] ##########

So, what do you see here, and is there something that comes next? Thanks very much for your help!!

Jacee · Jan 8, 2013

Please download TFC by Old Timer TFC - Temp File Cleaner by OldTimer - Geeks to Go Forums and save it to your desktop.
Save any unsaved work. TFC will close ALL open programs including your browser!
Double-click on TFC.exe to run it. If you are using Vista/Windows 7 right-click on the file and choose Run As Administrator.
Click the Start button to begin the cleaning process and let it run uninterrupted to completion.
Important! If TFC prompts you to reboot, please do so immediately. If not prompted, manually reboot the machine anyway to ensure a complete clean.

Tell me if you're still getting 'script errors' or being redirected.

njkaruna · Jan 8, 2013

Thanks Jacee

Thanks again Jacee -- you are very kind to be so helpful!

I have done as you suggested and loaded TFC and then rebooted. Unfortunately, I am still getting the script error messages.

Do you have additional suggestions?

Thanks.

Jacee · Jan 9, 2013

Click Control Panel -> Programs and Features. Tell me What version of Java is installed.

njkaruna · Jan 9, 2013

Script Errors

Thanks Jacee.

It looks like I installed Java 7, update 10 on 12/18/12. I remember running across an icon on my desktop that was a log of a java fatal error from August. So I went on the Java website to send a "bug report," and as part of that I downloaded Java7, update 10. I have not heard from them, in fact I am not sure it arrived, as my login seemed to fail/stall. Now that I think about it, could that "fatal error" have anything to do with this script error issue? I can paste that log here if you like ....

Thanks Jacee.

Jacee · Jan 10, 2013

Please download VEW by Vino Rosso http://images.malwareremoval.com/vino/VEW.exe
and save it to your desktop

Double click it to start it Note: If running Windows Vista or Windows 7 you will need to right click the file and select Run as administrator and click Continue or Allow at the User Account Control Prompt.
Click the check boxes next to Application and System located under Select log to query on the upper left

Under Select type to list on the right click the boxes next to Error and Warning Note: If running Windows Vista or Windows 7 also click the box next to Critical (not XP).
Under Number or date of events select Number of events and type 20 in the box next to 1 to 20 and click Run

Once it finishes it will display a log file in notepad
Please copy and paste its entire contents into your next reply

Jacee · Jan 10, 2013

Also, please copy and paste this lines in notepad:
@Echo on
pushd\windows\system32\drivers\etc
attrib -h -s -r hosts
echo 127.0.0.1 localhost>HOSTS
attrib +r +h +s hosts
popd
ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock reset all
netsh int ip reset all
shutdown -r -t 1
del %0

Save as flush.bat to your desktop.
Right click the .bat file and choose to run as Administrator. Your computer will reboot itself.

Let me know how you're doing now.

njkaruna · Jan 10, 2013

VEW

Hi Jacee.

I am having trouble accessing VEW. My computer won't display the page when I click or paste the address. I can bring up the malware removal website, but I can't seem to get at VEW. I am stumped.

njkaruna · Jan 10, 2013

Flush.bat

Hi Jacee. Thanks so much for helping.

I copied and ran the flush.bat list, and the computer rebooted -- magic!

Thanks. Still can't get at VEW. It must be in the shop or something ...

Jacee · Jan 11, 2013

When you click on my link, does this appear at the bottom of your screen? This is a direct download, so don't try to reach it through the address bar.

njkaruna · Jan 11, 2013

VEW Log

Hi Jacee. Managed to run VEW today. Here is log (in two parts as it is too long)

Vino's Event Viewer v01c run on Windows 2008 in English
Report run at 11/01/2013 4:58:39 PM
Note: All dates below are in the format dd/mm/yyyy
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Critical Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'Application' Date/Time: 11/01/2013 1:00:21 AM
Type: Error Category: 0
Event: 10 Source: Microsoft-Windows-WMI
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Log: 'Application' Date/Time: 11/01/2013 12:01:40 AM
Type: Error Category: 0
Event: 10 Source: Microsoft-Windows-WMI
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Log: 'Application' Date/Time: 10/01/2013 7:10:49 PM
Type: Error Category: 0
Event: 8193 Source: System Restore
Failed to create restore point (Process = C:\Program Files (x86)\STOPzilla!\SZScanner.exe Files (x86)\STOPzilla!\SZScanner.exe" ; Description = StopZILLA! Restore Point.; Error = 0x80042319).
Log: 'Application' Date/Time: 10/01/2013 8:45:42 AM
Type: Error Category: 0
Event: 10 Source: Microsoft-Windows-WMI
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Log: 'Application' Date/Time: 10/01/2013 8:00:16 AM
Type: Error Category: 0
Event: 100 Source: Bonjour Service
Task Scheduling Error: m->NextScheduledSPRetry 18798495
Log: 'Application' Date/Time: 10/01/2013 8:00:16 AM
Type: Error Category: 0
Event: 100 Source: Bonjour Service
Task Scheduling Error: m->NextScheduledEvent 18798495
Log: 'Application' Date/Time: 10/01/2013 8:00:16 AM
Type: Error Category: 0
Event: 100 Source: Bonjour Service
Task Scheduling Error: Continuously busy for more than a second
Log: 'Application' Date/Time: 09/01/2013 6:21:11 PM
Type: Error Category: 0
Event: 10 Source: Microsoft-Windows-WMI
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Log: 'Application' Date/Time: 09/01/2013 6:07:26 PM
Type: Error Category: 0
Event: 8193 Source: System Restore
Failed to create restore point (Process = C:\Program Files (x86)\STOPzilla!\SZScanner.exe Files (x86)\STOPzilla!\SZScanner.exe" ; Description = StopZILLA! Restore Point.; Error = 0x80042319).
Log: 'Application' Date/Time: 09/01/2013 5:40:31 PM
Type: Error Category: 0
Event: 8193 Source: System Restore
Failed to create restore point (Process = C:\Program Files (x86)\STOPzilla!\SZScanner.exe Files (x86)\STOPzilla!\SZScanner.exe" ; Description = StopZILLA! Restore Point.; Error = 0x80042319).
Log: 'Application' Date/Time: 08/01/2013 7:17:14 PM
Type: Error Category: 0
Event: 10 Source: Microsoft-Windows-WMI
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Log: 'Application' Date/Time: 08/01/2013 6:48:20 PM
Type: Error Category: 0
Event: 10 Source: Microsoft-Windows-WMI
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Log: 'Application' Date/Time: 08/01/2013 6:37:08 PM
Type: Error Category: 0
Event: 10 Source: Microsoft-Windows-WMI
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Log: 'Application' Date/Time: 08/01/2013 1:36:42 PM
Type: Error Category: 0
Event: 10 Source: Microsoft-Windows-WMI
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Log: 'Application' Date/Time: 08/01/2013 4:46:27 AM
Type: Error Category: 101
Event: 1002 Source: Application Hang
The program SZOptions.exe version 6.0.3.73 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel. Process ID: 76c Start Time: 01cded5af8ad57f8 Termination Time: 10 Application Path: C:\Program Files (x86)\STOPzilla!\SZOptions.exe Report Id: 53bce081-594e-11e2-9f05-d0df9a3f1794
Log: 'Application' Date/Time: 08/01/2013 4:45:29 AM
Type: Error Category: 0
Event: 10 Source: Microsoft-Windows-WMI
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Log: 'Application' Date/Time: 07/01/2013 11:41:40 PM
Type: Error Category: 0
Event: 10 Source: Microsoft-Windows-WMI
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Log: 'Application' Date/Time: 07/01/2013 11:26:28 PM
Type: Error Category: 0
Event: 10 Source: Microsoft-Windows-WMI
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Log: 'Application' Date/Time: 07/01/2013 9:46:37 PM
Type: Error Category: 0
Event: 10 Source: Microsoft-Windows-WMI
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Log: 'Application' Date/Time: 07/01/2013 3:48:57 PM
Type: Error Category: 0
Event: 8193 Source: System Restore
Failed to create restore point (Process = C:\Program Files (x86)\STOPzilla!\SZScanner.exe Files (x86)\STOPzilla!\SZScanner.exe" ; Description = StopZILLA! Restore Point.; Error = 0x80042319).
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Warning Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'Application' Date/Time: 11/01/2013 12:58:10 AM
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 10 user registry handles leaked from \Registry\User\S-1-5-21-1585631881-3667024588-2436863049-1000_Classes:
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\internet settings
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\internet settings
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000_CLASSES\.exe\shell\open
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000_CLASSES\.exe\shell\open
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000_CLASSES\.exe
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000_CLASSES\.exe
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000_CLASSES\exefile\shell\open
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000_CLASSES\exefile\shell\open
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000_CLASSES\.exe\shell\runas
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000_CLASSES\.exe\shell\runas

Log: 'Application' Date/Time: 11/01/2013 12:58:10 AM
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 36 user registry handles leaked from \Registry\User\S-1-5-21-1585631881-3667024588-2436863049-1000:
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Internet Explorer\MenuExt
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\Run
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Internet Explorer\Main
Process 1236 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Internet Explorer\Main
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Internet Explorer\Desktop\components
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Control Panel\International
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Policies\Microsoft\internet explorer\control panel
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\layers
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\runservicesonce
Process 1236 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\runservices
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\Policies\explorer
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Control Panel\Desktop
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Internet Explorer\Styles
Process 1236 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Policies
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Internet Explorer\Desktop\General
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Internet Explorer\Toolbar
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\Policies\explorer\run
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\setup
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Internet Explorer\URLSearchHooks
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Policies\Microsoft\internet explorer\restrictions
Process 1236 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\runonceex
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Internet Explorer\Extensions
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Internet Explorer\search
Process 1236 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 1236 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Internet Explorer\SearchUrl

njkaruna · Jan 11, 2013

VEW Log continued -- Part 2/3

Log: 'Application' Date/Time: 11/01/2013 12:45:23 AM
Type: Warning Category: 0
Event: 36 Source: Outlook
Outlook Search has encountered an error and is temporarily disabling indexing for store C:\Users\anne\AppData\Local\Microsoft\Outlook\Outlook.pst (error=0x800706ba).
Log: 'Application' Date/Time: 10/01/2013 11:59:21 PM
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 10 user registry handles leaked from \Registry\User\S-1-5-21-1585631881-3667024588-2436863049-1000_Classes:
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\internet settings
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\internet settings
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000_CLASSES\.exe\shell\open
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000_CLASSES\.exe\shell\open
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000_CLASSES\.exe
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000_CLASSES\.exe
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000_CLASSES\exefile\shell\open
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000_CLASSES\exefile\shell\open
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000_CLASSES\.exe\shell\runas
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000_CLASSES\.exe\shell\runas

Log: 'Application' Date/Time: 10/01/2013 11:59:20 PM
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 36 user registry handles leaked from \Registry\User\S-1-5-21-1585631881-3667024588-2436863049-1000:
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Internet Explorer\MenuExt
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\Run
Process 1352 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Internet Explorer\Main
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Internet Explorer\Main
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Internet Explorer\Desktop\components
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Control Panel\International
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Policies\Microsoft\internet explorer\control panel
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\layers
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\runservicesonce
Process 1352 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\runservices
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\Policies\explorer
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Control Panel\Desktop
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Internet Explorer\Styles
Process 1352 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Policies
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Internet Explorer\Desktop\General
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Internet Explorer\Toolbar
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\Policies\explorer\run
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\setup
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Internet Explorer\URLSearchHooks
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Policies\Microsoft\internet explorer\restrictions
Process 1352 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\runonceex
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Internet Explorer\Extensions
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Internet Explorer\search
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 1352 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 1352 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 116 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Internet Explorer\SearchUrl

Log: 'Application' Date/Time: 10/01/2013 7:20:36 PM
Type: Warning Category: 0
Event: 36 Source: Outlook
Outlook Search has encountered an error and is temporarily disabling indexing for store C:\Users\anne\AppData\Local\Microsoft\Outlook\Outlook.pst (error=0x800706ba).
Log: 'Application' Date/Time: 10/01/2013 7:10:49 PM
Type: Warning Category: 0
Event: 12301 Source: VSS
Volume Shadow Copy Service error: Writer MSSearch Service Writer did not respond to a GatherWriterStatus call.
Operation:
Gather writers' status
Executing Asynchronous Operation
Context:
Current State: GatherWriterStatus
Log: 'Application' Date/Time: 10/01/2013 12:45:39 PM
Type: Warning Category: 3
Event: 3036 Source: Microsoft-Windows-Search
The content source <csc://{S-1-5-21-1585631881-3667024588-2436863049-1000}/> cannot be accessed.
Context: Application, SystemIndex Catalog
Details:
(HRESULT : 0x80004005) (0x80004005)

Log: 'Application' Date/Time: 10/01/2013 9:45:39 AM
Type: Warning Category: 3
Event: 3036 Source: Microsoft-Windows-Search
The content source <csc://{S-1-5-21-1585631881-3667024588-2436863049-1000}/> cannot be accessed.
Context: Application, SystemIndex Catalog
Details:
(HRESULT : 0x80004005) (0x80004005)

Log: 'Application' Date/Time: 10/01/2013 8:49:15 AM
Type: Warning Category: 0
Event: 1021 Source: .NET Runtime
.NET Runtime version 2.0.50727.5466 - Executable "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe" AppDomain "DefaultDomain" deleted obsolete native image "C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\187d7c66735c533de851c76384f86912\mscorlib.ni.dll"
Log: 'Application' Date/Time: 10/01/2013 8:47:30 AM
Type: Warning Category: 0
Event: 1021 Source: .NET Runtime
.NET Runtime version 2.0.50727.5466 - Executable "C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe" AppDomain "IAStorDataMgrSvc.exe" deleted obsolete native image "C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\3343dd79a8a8fc1befde1635a3532e0c\IAStorCommon.ni.dll"
Log: 'Application' Date/Time: 10/01/2013 8:45:45 AM
Type: Warning Category: 0
Event: 1021 Source: .NET Runtime
.NET Runtime version 2.0.50727.5466 - Executable "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe" AppDomain "DefaultDomain" deleted obsolete native image "C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\74a5f0c2bc0d0e6e3c4ec4886b9be891\mscorlib.ni.dll"
Log: 'Application' Date/Time: 10/01/2013 8:45:41 AM
Type: Warning Category: 3
Event: 3036 Source: Microsoft-Windows-Search
The content source <csc://{S-1-5-21-1585631881-3667024588-2436863049-1000}/> cannot be accessed.
Context: Application, SystemIndex Catalog
Details:
(HRESULT : 0x80004005) (0x80004005)

Log: 'Application' Date/Time: 10/01/2013 8:42:50 AM
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 10 user registry handles leaked from \Registry\User\S-1-5-21-1585631881-3667024588-2436863049-1000_Classes:
Process 324 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\internet settings
Process 324 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\internet settings
Process 324 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000_CLASSES\.exe\shell\open
Process 324 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000_CLASSES\.exe\shell\open
Process 324 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000_CLASSES\.exe
Process 324 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000_CLASSES\.exe
Process 324 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000_CLASSES\exefile\shell\open
Process 324 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000_CLASSES\exefile\shell\open
Process 324 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000_CLASSES\.exe\shell\runas
Process 324 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000_CLASSES\.exe\shell\runas

njkaruna · Jan 11, 2013

VEW Log continued 2.5/3

Log: 'Application' Date/Time: 10/01/2013 8:42:49 AM
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 30 user registry handles leaked from \Registry\User\S-1-5-21-1585631881-3667024588-2436863049-1000:
Process 324 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system
Process 324 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults
Process 324 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Internet Explorer\MenuExt
Process 324 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\Run
Process 324 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Internet Explorer\Main
Process 324 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Internet Explorer\Desktop\components
Process 324 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Control Panel\International
Process 324 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Policies\Microsoft\internet explorer\control panel
Process 324 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\layers
Process 324 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\runservicesonce
Process 324 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\runservices
Process 324 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\Policies\explorer
Process 324 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall
Process 324 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce
Process 324 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Control Panel\Desktop
Process 324 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings
Process 324 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Internet Explorer\Styles
Process 324 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Internet Explorer\Desktop\General
Process 324 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Internet Explorer\Toolbar
Process 324 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Process 324 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\Policies\explorer\run
Process 324 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\setup
Process 324 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Internet Explorer\URLSearchHooks
Process 324 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows
Process 324 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Policies\Microsoft\internet explorer\restrictions
Process 324 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\runonceex
Process 324 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Internet Explorer\Extensions
Process 324 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Internet Explorer\search
Process 324 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 324 (\Device\HarddiskVolume3\Program Files (x86)\STOPzilla!\SZServer.exe) has opened key \REGISTRY\USER\S-1-5-21-1585631881-3667024588-2436863049-1000\Software\Microsoft\Internet Explorer\SearchUrl
Log: 'Application' Date/Time: 10/01/2013 8:30:05 AM
Type: Warning Category: 0
Event: 1130 Source: .NET Runtime Optimization Service
.NET Runtime Optimization Service (4.0.30319.296) - Version or flavor did not match with repository: Microsoft.VisualBasic.Compatibility.Data
Log: 'Application' Date/Time: 10/01/2013 8:25:44 AM
Type: Warning Category: 1
Event: 1020 Source: ASP.NET 4.0.30319.0
Updates to the IIS metabase were aborted because IIS is either not installed or is disabled on this machine. To configure ASP.NET to run in IIS, please install or enable IIS and re-register ASP.NET using aspnet_regiis.exe /i.
Log: 'Application' Date/Time: 10/01/2013 8:25:38 AM
Type: Warning Category: 1
Event: 1020 Source: ASP.NET 4.0.30319.0
Updates to the IIS metabase were aborted because IIS is either not installed or is disabled on this machine. To configure ASP.NET to run in IIS, please install or enable IIS and re-register ASP.NET using aspnet_regiis.exe /i.
Log: 'Application' Date/Time: 10/01/2013 8:18:12 AM
Type: Warning Category: 0
Event: 10010 Source: Microsoft-Windows-RestartManager
Application 'C:\Program Files (x86)\Norton PC Checkup 3.0\PCCU.exe' (pid 3164) cannot be restarted - Application SID does not match Conductor SID..
Log: 'Application' Date/Time: 10/01/2013 8:18:12 AM
Type: Warning Category: 0
Event: 10010 Source: Microsoft-Windows-RestartManager
Application 'C:\Program Files (x86)\Norton PC Checkup 3.0\PCCU.exe' (pid 3164) cannot be restarted - Application SID does not match Conductor SID..
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

njkaruna · Jan 11, 2013

VEW Log continued 3/3

'System' Log - Critical Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 08/01/2013 6:35:29 PM
Type: Critical Category: 63
Event: 41 Source: Microsoft-Windows-Kernel-Power
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
Log: 'System' Date/Time: 06/01/2013 7:50:53 PM
Type: Critical Category: 63
Event: 41 Source: Microsoft-Windows-Kernel-Power
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
Log: 'System' Date/Time: 06/01/2013 7:21:06 PM
Type: Critical Category: 63
Event: 41 Source: Microsoft-Windows-Kernel-Power
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
Log: 'System' Date/Time: 04/01/2013 9:56:00 PM
Type: Critical Category: 63
Event: 41 Source: Microsoft-Windows-Kernel-Power
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
Log: 'System' Date/Time: 31/12/2012 6:40:28 PM
Type: Critical Category: 63
Event: 41 Source: Microsoft-Windows-Kernel-Power
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
Log: 'System' Date/Time: 31/12/2012 6:32:13 PM
Type: Critical Category: 63
Event: 41 Source: Microsoft-Windows-Kernel-Power
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
Log: 'System' Date/Time: 29/12/2012 5:54:10 PM
Type: Critical Category: 63
Event: 41 Source: Microsoft-Windows-Kernel-Power
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
Log: 'System' Date/Time: 27/12/2012 7:18:58 PM
Type: Critical Category: 63
Event: 41 Source: Microsoft-Windows-Kernel-Power
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
Log: 'System' Date/Time: 26/12/2012 5:43:21 AM
Type: Critical Category: 63
Event: 41 Source: Microsoft-Windows-Kernel-Power
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
Log: 'System' Date/Time: 22/12/2012 2:00:41 AM
Type: Critical Category: 63
Event: 41 Source: Microsoft-Windows-Kernel-Power
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
Log: 'System' Date/Time: 19/12/2012 8:53:15 PM
Type: Critical Category: 63
Event: 41 Source: Microsoft-Windows-Kernel-Power
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
Log: 'System' Date/Time: 18/12/2012 6:01:23 PM
Type: Critical Category: 63
Event: 41 Source: Microsoft-Windows-Kernel-Power
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
Log: 'System' Date/Time: 18/12/2012 2:35:03 AM
Type: Critical Category: 63
Event: 41 Source: Microsoft-Windows-Kernel-Power
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
Log: 'System' Date/Time: 17/12/2012 11:20:37 PM
Type: Critical Category: 63
Event: 41 Source: Microsoft-Windows-Kernel-Power
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
Log: 'System' Date/Time: 15/12/2012 10:52:46 PM
Type: Critical Category: 63
Event: 41 Source: Microsoft-Windows-Kernel-Power
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
Log: 'System' Date/Time: 28/09/2012 8:00:22 PM
Type: Critical Category: 63
Event: 41 Source: Microsoft-Windows-Kernel-Power
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 11/01/2013 3:12:30 AM
Type: Error Category: 0
Event: 8003 Source: bowser
The master browser has received a server announcement from the computer BUCK-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{BA7FB304-0598-44D2-BA04-BB77413308DF}. The master browser is stopping or an election is being forced.
Log: 'System' Date/Time: 11/01/2013 1:01:36 AM
Type: Error Category: 0
Event: 7009 Source: Service Control Manager
A timeout was reached (30000 milliseconds) while waiting for the Roxio Hard Drive Watcher 12 service to connect.
Log: 'System' Date/Time: 11/01/2013 12:59:31 AM
Type: Error Category: 0
Event: 7026 Source: Service Control Manager
The following boot-start or system-start driver(s) failed to load: is3srv
Log: 'System' Date/Time: 11/01/2013 12:59:16 AM
Type: Error Category: 0
Event: 7001 Source: Service Control Manager
The NTRU TSS v1.2.1.34 TCS service depends on the TPM Base Services service which failed to start because of the following error: The operation completed successfully.
Log: 'System' Date/Time: 11/01/2013 12:03:04 AM
Type: Error Category: 0
Event: 7009 Source: Service Control Manager
A timeout was reached (30000 milliseconds) while waiting for the Roxio Hard Drive Watcher 12 service to connect.
Log: 'System' Date/Time: 11/01/2013 12:00:59 AM
Type: Error Category: 0
Event: 7026 Source: Service Control Manager
The following boot-start or system-start driver(s) failed to load: is3srv
Log: 'System' Date/Time: 11/01/2013 12:00:46 AM
Type: Error Category: 0
Event: 7001 Source: Service Control Manager
The NTRU TSS v1.2.1.34 TCS service depends on the TPM Base Services service which failed to start because of the following error: The operation completed successfully.
Log: 'System' Date/Time: 10/01/2013 11:59:16 PM
Type: Error Category: 0
Event: 10010 Source: Microsoft-Windows-DistributedCOM
The server {51FA2736-5DEE-11D4-98E8-006008BF430C} did not register with DCOM within the required timeout.
Log: 'System' Date/Time: 10/01/2013 8:47:49 AM
Type: Error Category: 0
Event: 8032 Source: BROWSER
The browser service has failed to retrieve the backup list too many times on transport \Device\NetBT_Tcpip_{BA7FB304-0598-44D2-BA04-BB77413308DF}. The backup browser is stopping.
Log: 'System' Date/Time: 10/01/2013 8:47:29 AM
Type: Error Category: 0
Event: 7009 Source: Service Control Manager
A timeout was reached (30000 milliseconds) while waiting for the Roxio Hard Drive Watcher 12 service to connect.
Log: 'System' Date/Time: 10/01/2013 8:45:26 AM
Type: Error Category: 0
Event: 7026 Source: Service Control Manager
The following boot-start or system-start driver(s) failed to load: is3srv
Log: 'System' Date/Time: 10/01/2013 8:45:12 AM
Type: Error Category: 0
Event: 7001 Source: Service Control Manager
The NTRU TSS v1.2.1.34 TCS service depends on the TPM Base Services service which failed to start because of the following error: The operation completed successfully.
Log: 'System' Date/Time: 10/01/2013 8:42:59 AM
Type: Error Category: 0
Event: 10010 Source: Microsoft-Windows-DistributedCOM
The server {51FA2736-5DEE-11D4-98E8-006008BF430C} did not register with DCOM within the required timeout.
Log: 'System' Date/Time: 10/01/2013 8:02:43 AM
Type: Error Category: 0
Event: 8032 Source: BROWSER
The browser service has failed to retrieve the backup list too many times on transport \Device\NetBT_Tcpip_{BA7FB304-0598-44D2-BA04-BB77413308DF}. The backup browser is stopping.
Log: 'System' Date/Time: 09/01/2013 6:22:12 PM
Type: Error Category: 0
Event: 7009 Source: Service Control Manager
A timeout was reached (30000 milliseconds) while waiting for the Roxio Hard Drive Watcher 12 service to connect.
Log: 'System' Date/Time: 09/01/2013 6:20:10 PM
Type: Error Category: 0
Event: 7026 Source: Service Control Manager
The following boot-start or system-start driver(s) failed to load: is3srv
Log: 'System' Date/Time: 09/01/2013 6:20:02 PM
Type: Error Category: 0
Event: 7001 Source: Service Control Manager
The NTRU TSS v1.2.1.34 TCS service depends on the TPM Base Services service which failed to start because of the following error: The operation completed successfully.
Log: 'System' Date/Time: 08/01/2013 7:18:43 PM
Type: Error Category: 0
Event: 7009 Source: Service Control Manager
A timeout was reached (30000 milliseconds) while waiting for the Roxio Hard Drive Watcher 12 service to connect.
Log: 'System' Date/Time: 08/01/2013 7:17:31 PM
Type: Error Category: 0
Event: 10010 Source: Microsoft-Windows-DistributedCOM
The server {4EB61BAC-A3B6-4760-9581-655041EF4D69} did not register with DCOM within the required timeout.
Log: 'System' Date/Time: 08/01/2013 7:16:39 PM
Type: Error Category: 0
Event: 7026 Source: Service Control Manager
The following boot-start or system-start driver(s) failed to load: is3srv
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Warning Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 11/01/2013 5:50:13 PM
Type: Warning Category: 7
Event: 37 Source: Microsoft-Windows-Kernel-Processor-Power
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 22 seconds since the last report.
Log: 'System' Date/Time: 11/01/2013 5:50:13 PM
Type: Warning Category: 7
Event: 37 Source: Microsoft-Windows-Kernel-Processor-Power
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 22 seconds since the last report.
Log: 'System' Date/Time: 11/01/2013 5:50:12 PM
Type: Warning Category: 7
Event: 37 Source: Microsoft-Windows-Kernel-Processor-Power
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 22 seconds since the last report.
Log: 'System' Date/Time: 11/01/2013 5:50:12 PM
Type: Warning Category: 7
Event: 37 Source: Microsoft-Windows-Kernel-Processor-Power
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 22 seconds since the last report.
Log: 'System' Date/Time: 11/01/2013 5:09:34 PM
Type: Warning Category: 0
Event: 1014 Source: Microsoft-Windows-DNS-Client
Name resolution for the name shasta-clt.symantec.com timed out after none of the configured DNS servers responded.
Log: 'System' Date/Time: 11/01/2013 4:55:19 PM
Type: Warning Category: 0
Event: 1014 Source: Microsoft-Windows-DNS-Client
Name resolution for the name spoc-pool-gtm.norton.com timed out after none of the configured DNS servers responded.
Log: 'System' Date/Time: 11/01/2013 4:55:18 PM
Type: Warning Category: 0
Event: 1014 Source: Microsoft-Windows-DNS-Client
Name resolution for the name client.akamai.com timed out after none of the configured DNS servers responded.
Log: 'System' Date/Time: 11/01/2013 4:55:13 PM
Type: Warning Category: 0
Event: 1014 Source: Microsoft-Windows-DNS-Client
Name resolution for the name isatap.Belkin timed out after none of the configured DNS servers responded.
Log: 'System' Date/Time: 11/01/2013 4:55:08 PM
Type: Warning Category: 0
Event: 27 Source: e1cexpress
Intel(R) 82579LM Gigabit Network Connection Network link is disconnected.
Log: 'System' Date/Time: 11/01/2013 3:11:56 AM
Type: Warning Category: 0
Event: 1014 Source: Microsoft-Windows-DNS-Client
Name resolution for the name BUCK-PC.belkin timed out after none of the configured DNS servers responded.
Log: 'System' Date/Time: 11/01/2013 3:11:17 AM
Type: Warning Category: 0
Event: 1014 Source: Microsoft-Windows-DNS-Client
Name resolution for the name BUCK-PC.belkin timed out after none of the configured DNS servers responded.
Log: 'System' Date/Time: 11/01/2013 2:05:53 AM
Type: Warning Category: 0
Event: 1014 Source: Microsoft-Windows-DNS-Client
Name resolution for the name dns.msftncsi.com timed out after none of the configured DNS servers responded.
Log: 'System' Date/Time: 11/01/2013 2:02:11 AM
Type: Warning Category: 0
Event: 1014 Source: Microsoft-Windows-DNS-Client
Name resolution for the name postnewsweekmedia.112.2o7.net timed out after none of the configured DNS servers responded.
Log: 'System' Date/Time: 11/01/2013 1:34:47 AM
Type: Warning Category: 0
Event: 10002 Source: Microsoft-Windows-WLAN-AutoConfig
WLAN Extensibility Module has stopped. Module Path: C:\Windows\System32\bcmihvsrv64.dll
Log: 'System' Date/Time: 11/01/2013 1:34:24 AM
Type: Warning Category: 0
Event: 1014 Source: Microsoft-Windows-DNS-Client
Name resolution for the name BOTANICALBLOOMS.belkin timed out after none of the configured DNS servers responded.
Log: 'System' Date/Time: 11/01/2013 1:06:53 AM
Type: Warning Category: 0
Event: 1014 Source: Microsoft-Windows-DNS-Client
Name resolution for the name www.earthlink.net timed out after none of the configured DNS servers responded.
Log: 'System' Date/Time: 11/01/2013 12:59:17 AM
Type: Warning Category: 0
Event: 11 Source: Microsoft-Windows-Wininit
Custom dynamic link libraries are being loaded for every application. The system administrator should review the list of libraries to ensure they are related to trusted applications.
Log: 'System' Date/Time: 11/01/2013 12:59:07 AM
Type: Warning Category: 0
Event: 27 Source: e1cexpress
Intel(R) 82579LM Gigabit Network Connection Network link is disconnected.
Log: 'System' Date/Time: 11/01/2013 12:59:05 AM
Type: Warning Category: 212
Event: 219 Source: Microsoft-Windows-Kernel-PnP
The driver \Driver\WUDFRd failed to load for the device USB\VID_0A5C&PID_5801&MI_01\7&1eb0f4e8&0&0001.
Log: 'System' Date/Time: 11/01/2013 12:58:18 AM
Type: Warning Category: 0
Event: 4001 Source: Microsoft-Windows-WLAN-AutoConfig
WLAN AutoConfig service has successfully stopped.

Thanks Jacee.

Jacee · Jan 11, 2013

Uninstall StopZilla! How to Remove STOPzilla | eHow.com

Please download (free version) Malwarebytes' Anti-Malware to your desktop
http://www.malwarebytes.org/products/malwarebytes_free/
* Double-click mbam-setup.exe and follow the prompts to install the program.Right click to run as Administrator, using Windows 7 or Vista.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad. Please save it to a convenient location. Copy and Paste that log into your next reply.

contant script error messages due to virus

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

Consumer Security

My Computer

New member

My Computer

Consumer Security

My Computer

New member

My Computer

Consumer Security

My Computer

New member

My Computer

Consumer Security

My Computer

Consumer Security

My Computer

New member

My Computer

New member

My Computer

Consumer Security

Attachments

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

Consumer Security

My Computer

Similar threads