[Soundy]

Once again, multiple corrupt files like that are usually the result of bad RAM, bad hard drive, or both. Since XP installed alright, I'd say it's probably not RAM - that leaves the drive.

Just because the program you used says the drive is "healthy" doesn't mean anything; it's probably just reading the drive's SMART data, which effectively only refers to the drive's mechanical status. It could have a large block of bad sectors that SMART wouldn't pick up.

Download the diagnostics from Western Digital's website - get the "Data Lifeguard Diagnostics" from http://support.wdc.com (look right in the middle of the page). You'll probably want the "Floppy" version - download it on another machine and create a floppy disk from it, then boot that on this machine.

[mommyoffive]

Okay, I just tried to install Java, so I could run Housecall on my computer, but it also gave me an error code....#1722. It's just not letting me install anything at this point!

Sorry.....just saw that someone replied! I get different error codes and messages depending on what I'm trying to install. Most of them say something about having corrupt files and then it rolls back.

[mommyoffive]

Okay, thanks. I'll try that as soon as I'm able to find a disc and another computer. LOL Would a disk defrag help this issue at all?

[Soundy]

A defrag won't help; if the drive has bad sectors, in fact, it will probably corrupt some of what you've already got installed. You could try doing a "full" scandisk - open My Computer, right-click the drive, go to Properties, Tools, Error Checking, Check Now, check both boxes, and hit Start. It SHOULD then complain about the disk being in use and ask if you want to run the check on the next reboot.

[Blackmirror]

This is a legal copy of windows isnt it
its not a copy ???

Sorry had to ask l

See here please

http://www.microsoft.com/downloads/d...DisplayLang=en

[Cookiegal]

Also, go to Start - Run - type in eventvwr.msc and click OK. Look under "system" for an recent errors shown in red. Double click to open them one at a time and then click on the icon that looks like two pieces of paper to save the error to the clipboard. Then paste them into Word or Notepad and copy and paste them all here.

[mommyoffive]

Okay, I was able to download this program for some reason. Here is the log of what I got:

Test Option: EXTENDED TEST
Model Number: WDC WD136BA
Unit Serial Number: WD-WMA041038093
Firmware Number: 16.13M16
Capacity: 13.67 GB
SMART Status: PASS
Test Result: PASS
Test Time: 14:04:34, June 28, 2007

Originally Posted by Soundy

Just because the program you used says the drive is "healthy" doesn't mean anything; it's probably just reading the drive's SMART data, which effectively only refers to the drive's mechanical status. It could have a large block of bad sectors that SMART wouldn't pick up.

Download the diagnostics from Western Digital's website - get the "Data Lifeguard Diagnostics" from http://support.wdc.com (look right in the middle of the page). You'll probably want the "Floppy" version - download it on another machine and create a floppy disk from it, then boot that on this machine.

[mommyoffive]

Followed your instructions, did a restart, and this is the message I received.

* File type is NTFS. Cannot open volume for access.

Originally Posted by Soundy

A defrag won't help; if the drive has bad sectors, in fact, it will probably corrupt some of what you've already got installed. You could try doing a "full" scandisk - open My Computer, right-click the drive, go to Properties, Tools, Error Checking, Check Now, check both boxes, and hit Start. It SHOULD then complain about the disk being in use and ask if you want to run the check on the next reboot.

[mommyoffive]

Yes, it is a legal copy. My computer shut down when I was trying to reply last time. On startup this time, it allowed the full scandisk. It was scanning too fast for me to right everything down, but it did complete the scan and these are some of the things that it did and repaired.

*Deleting corrupt attribute record (several of them)
*Deleting index entry (several of them)
*Recovering orphaned file (several of them)
*Inserting data attribute (several of them)
*Windows replaced bad clusters (a whole bunch of them)
End note: Windows finished checking disc ~ Volume is clean.

I'm getting ready to copy the error messages from eventvwr.msc that CookieGal requested.

[Cookiegal]

Would you also post a new HijackThis log since the install please.

[mommyoffive]

I got rid of some of the junk. I was actually able to download Super/Anti-Spyware, but still can't do my Windows Updates, MSN Messenger, AVGfree, Java, etc. I highlighted something in red called poolsv.exe. I get an error message as soon as my desktop loads after a restart, and it says "poolsv.exe encountered a problem and needs to close." I don't know what it is. Thanks!


Logfile of HijackThis v1.99.1
Scan saved at 10:56:15 PM, on 6/28/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\MSN\MSNCoreFiles\msn6.exe
C:\Program Files\Hijackthis\HijackThis.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [poolsv] "C:\WINDOWS\poolsv.exe"
O4 - HKLM\..\Run: [GPLv3] rundll32.exe "C:\WINDOWS\System32\iqtdfmex.dll",realset
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://prerelease.trendmicro-europe....vex/hcImpl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1182969775340
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1182972473139

[Soundy]

Those lost clusters it found are your problem - ideally those are now marked as bad and won't be used again, but it's also probable that more will go bad over time. Probably be a good idea to look at a replacement drive.

[Cookiegal]

Let's go ahead and attempt to clean up the infection although it may be a futile effort. This may allow you to do other things, like download an anti-virus program.

See if you can download this program:

Please download VundoFix.exe to your desktop.

• Double-click VundoFix.exe to run it.
• Click the Scan for Vundo button.
• Once it's done scanning, click the Remove Vundo button.
• You will receive a prompt asking if you want to remove the files, click YES
• Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will reboot your computer, click OK.
• Please post the contents of C:\vundofix.txt and a new HiJackThis log in a reply to this thread.

Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button" when VundoFix appears upon rebooting.

[mommyoffive]

Originally Posted by Cookiegal

Also, go to Start - Run - type in eventvwr.msc and click OK. Look under "system" for an recent errors shown in red. Double click to open them one at a time and then click on the icon that looks like two pieces of paper to save the error to the clipboard. Then paste them into Word or Notepad and copy and paste them all here.

Sorry!! I've had a real mess since I last posted. Seems like when I have to shutdown the computer for any reason, it starts it's stuff again! I've had to reinstall XP once again since we last talked. I couldn't even access anything in the eventvwr.msc before I did the reinstall. But, it worked fine now, so here is the log from it. There were actually alot less errors this time......before the reinstall, I had about 30 errors! I also ran the VundoFix.exe program, but there were no infections.....probably since I just did another clean reinstall.

Eventvwr.msc

Error #1

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7003
Date: 6/29/2007
Time: 3:15:30 PM
User: N/A
Computer: TERESA-2EXMJ6UF
Description:
The Messenger service depends on the following nonexistent service: NetBIOS

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

#2

Event Type: Error
Event Source: ipnathlp
Event Category: None
Event ID: 32003
Date: 6/29/2007
Time: 3:14:10 PM
User: N/A
Computer: TERESA-2EXMJ6UF
Description:
The Network Address Translator (NAT) was unable to request an operation of the kernel-mode translation module. This may indicate misconfiguration, insufficient resources, or an internal error. The data is the error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 1f 00 00 00 ....

#3

Event Type: Error
Event Source: ipnathlp
Event Category: None
Event ID: 32003
Date: 6/29/2007
Time: 3:14:10 PM
User: N/A
Computer: TERESA-2EXMJ6UF
Description:
The Network Address Translator (NAT) was unable to request an operation of the kernel-mode translation module. This may indicate misconfiguration, insufficient resources, or an internal error. The data is the error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 1f 00 00 00 ....

#4

Event Type: Error
Event Source: ipnathlp
Event Category: None
Event ID: 32003
Date: 6/29/2007
Time: 3:14:10 PM
User: N/A
Computer: TERESA-2EXMJ6UF
Description:
The Network Address Translator (NAT) was unable to request an operation of the kernel-mode translation module. This may indicate misconfiguration, insufficient resources, or an internal error. The data is the error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 1f 00 00 00 ....

#5

Event Type: Error
Event Source: ipnathlp
Event Category: None
Event ID: 32003
Date: 6/29/2007
Time: 3:14:10 PM
User: N/A
Computer: TERESA-2EXMJ6UF
Description:
The Network Address Translator (NAT) was unable to request an operation of the kernel-mode translation module. This may indicate misconfiguration, insufficient resources, or an internal error. The data is the error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 1f 00 00 00 ....

#6

Event Type: Error
Event Source: Setup
Event Category: None
Event ID: 60055
Date: 6/29/2007
Time: 3:12:40 PM
User: N/A
Computer: TERESA-2EXMJ6UF
Description:
Windows Setup encountered non-fatal errors during installation. Please check the setuperr.log found in your Windows directory for more information.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

#7

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 6/29/2007
Time: 3:05:14 PM
User: NT AUTHORITY\SYSTEM
Computer: TERESA-2EXMJ6UF
Description:
DCOM got error "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. " attempting to start the service SENS with arguments "" in order to run the server:
{D3938AB0-5B9D-11D1-8DD2-00AA004ABD5E}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

#8

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 6/29/2007
Time: 3:05:14 PM
User: NT AUTHORITY\SYSTEM
Computer: TERESA-2EXMJ6UF
Description:
DCOM got error "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. " attempting to start the service SENS with arguments "" in order to run the server:
{D3938AB0-5B9D-11D1-8DD2-00AA004ABD5E}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

#9

Event Type: Error
Event Source: ipnathlp
Event Category: None
Event ID: 32003
Date: 6/29/2007
Time: 1:12:00 PM
User: N/A
Computer: TERESA-2EXMJ6UF
Description:
The Network Address Translator (NAT) was unable to request an operation of the kernel-mode translation module. This may indicate misconfiguration, insufficient resources, or an internal error. The data is the error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 1f 00 00 00 ....

#10

Event Type: Error
Event Source: ipnathlp
Event Category: None
Event ID: 32003
Date: 6/29/2007
Time: 1:12:00 PM
User: N/A
Computer: TERESA-2EXMJ6UF
Description:
The Network Address Translator (NAT) was unable to request an operation of the kernel-mode translation module. This may indicate misconfiguration, insufficient resources, or an internal error. The data is the error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 1f 00 00 00 ....

#11

Event Type: Error
Event Source: ipnathlp
Event Category: None
Event ID: 32003
Date: 6/29/2007
Time: 1:09:21 PM
User: N/A
Computer: TERESA-2EXMJ6UF
Description:
The Network Address Translator (NAT) was unable to request an operation of the kernel-mode translation module. This may indicate misconfiguration, insufficient resources, or an internal error. The data is the error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 1f 00 00 00 ....

#12

Event Type: Error
Event Source: NetBT
Event Category: None
Event ID: 4311
Date: 6/29/2007
Time: 1:08:16 PM
User: N/A
Computer: TERESA-2EXMJ6UF
Description:
Initialization failed because the driver device could not be created.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 01 00 58 00 ......X.
0008: 00 00 00 00 d7 10 00 c0 ....×..À
0010: 11 01 00 00 01 00 00 c0 .......À
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

#13

Event Type: Error
Event Source: Setup
Event Category: None
Event ID: 60055
Date: 6/29/2007
Time: 12:47:35 PM
User: N/A
Computer: TERESA-2EXMJ6UF
Description:
Windows Setup encountered non-fatal errors during installation. Please check the setuperr.log found in your Windows directory for more information.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


Here's a new hijack log too per your request! Thanks again!

Logfile of HijackThis v1.99.1
Scan saved at 9:13:41 PM, on 6/29/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\dllhost.exe
C:\Program Files\MSN\MSNCoreFiles\msn6.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Hijackthis\HijackThis.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1183144591873

I really appreciate everyone's help!! I'm trying to avoid having to buy a new hard drive if at all possible....at least right now. I just moved cross-country a month ago and haven't found a job yet! Thanks!

[Soundy]

I suspect if you run the full SCANDISK again, it will find more bad clusters... sorry to say, but on a system this old, there's a good chance that the drive is slowly failing, and it will just keep getting worse.

Not the news you want to hear, obviously