[n3Xus]

hello,
as the topic name tells you, vista freezes when i want to start the task manager. the mouse still works for a second or two than my pc beeps and all i can do is to restart it.
ive tried system restore but it didnt help.
i dont really know what could be wrong except that ive installed some codecs so i can play system shock 2(regsrv32 somecodec.file in CMD).

im using vista 32 ultimate

[devil_himself]

First backup Your Registry

Win Key + R >> at Run Prompt > regedit /e c:\registrybackup.reg

now Download the Attached File ... unzip it and Merge It With Registry .. Restart

[n3Xus]

it doesnt work. i also get an error from windows defender :

Application failed to initialize: 0x800106ba. A problem cause this service to stop....than something about help blabla

[devil_himself]

Win Key + R > at the Run Prompt > eventvwr.msc

copy and paste some of the recent errors from application and System

[n3Xus]

from system:

1:

DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server:
{145B4335-FE2A-4927-A040-7C35AD3180EF}

2:

DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server:
{BA126AD1-2166-11D1-B1D0-00805FC1270E}

3:

DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server:
{A47979D2-C419-11D9-A5B4-001185AD2B89

4:

DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}

5:

DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server:
{DD522ACC-F821-461A-A407-50B198B896DC}

applications:

NOTE: the error #2 (LGVID.AX file is a move player thing for system shock 2) and some other were cause becouse of system shock 2.

1:

Faulting application flec006.exe, version 0.0.0.0, time stamp 0x00000000, faulting module ntdll.dll, version 6.0.6000.16386, time stamp 0x4549bdc9, exception code 0xc0000005, fault offset 0x00061884, process id 0xfe0, application start time 0x01c7f56235c4fa4e.

2:

Faulting application wmplayer.exe, version 11.0.6000.6324, time stamp 0x4549b52a, faulting module LGVID.AX, version 0.0.0.0, time stamp 0x325977a7, exception code 0xc0000005, fault offset 0x0000151d, process id 0xa5c, application start time 0x01c7f560d420f8ca.

3:
NOTE: ive got more errors like the following one:

A provider, WmiPerfClass, has been registered in the Windows Management Instrumentation namespace root\cimv2 to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.

4:

The COM+ Event System detected a bad return code during its internal processing. HRESULT was 8007043c from line 45 of d:\vistartm\com\complus\src\events\tier1\eventsystemobj.cpp. Please contact Microsoft Product Support Services to report this error.

5:
NOTE: media player got en error when i trie to open some files(system shock videos)

Faulting application wmplayer.exe, version 11.0.6000.6324, time stamp 0x4549b52a, faulting module lgvid.ax, version 0.0.0.0, time stamp 0x325977a7, exception code 0xc0000005, fault offset 0x0000151d, process id 0xc50, application start time 0x01c7f55d2ebf3f2f.

6:

Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005. This is often caused by incorrect security settings in either the writer or requestor process.

Operation:
Gathering Writer Data

Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {d2e46019-3b4d-498a-8101-0105800e4ade}

[devil_himself]

Remove the Software to Which it Belongs 'flec006.exe'

[n3Xus]

hm..how can i find out to which software it belongs? i went to the properties>details but it doesnt says anything usefull...

[devil_himself]

Hmm .. http://www.bleepingcomputer.com/star...exe-15244.html

Post a Hijack this log in the 'Malware Forum'

-----------------------------------------------------
Download HJTInstall.exe to your Desktop.

http://www.trendsecure.com/portal/en...HJTInstall.exe

* Doubleclick HJTInstall.exe to install it.
* By default it will install to C:\Program Files\Trend Micro\HijackThis .
* Click on Install.
* It will create a HijackThis icon on the desktop.
* Once installed, it will launch Hijackthis.
* Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
* Copy/Paste the log to your next reply please.

Don't use the Analyse This button, its findings are dangerous if misinterpreted.
Don't have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.

[n3Xus]

ok thx for your help