HELP! Photoshop is using all my RAM!

[Syd]

This is weird. It started two days ago and I can't seem to get to the bottom of it. When I open Photoshop and then open Task Manager and go to the Efficiency tab ( I think that is how you say it in English) I just watch as Photoshop steadily eats up all my RAM. And this is without even opening a file. It just starts using it up in 5mb increments until it is all gone and then everything jams up. I have 1.5 gigs of RAM and another 500megs on my video card and it hasn't been a problem up until now.

I went and shut everything down, even disconnected from the internet and opened Photoshop again but the same thing just happens. I Dumped Preferences and reset everything but that didn't help either. Photoshop is only set to use 55% of my RAM so I can't understand how this is happening. My Scratch Disk is set to the D drive which is empty.

Stange thing about it is, if you go to the Processes tab in Task Manager you will see Photoshop climb to its limit and then drop right down to 30 or 40 megs but in the Efficiency tab the computer is still maxed out and everything is jammed up or slowed down to a snails pace.

Anyone else ever experience this?

Syd

[Xaran]

I hate to say this but it really sounds like you have a virus on your computer.

If you do have anti virus software run a full system scan if you do not do a search for AVG Antivirus there is a free version for personal use.


Christine

[mistermonday]

Syd, Photoshop has been known to do some very strange things when its preference file gets corrupted. Before you go hunting for viruses I recommend that you reset the prefs by holding down the Ctrl+Alt+Shift while starting Photoshop. If it is strill doing it after you reset your prefs, then there is something else going on with other processes, services, or applications on your machine.
Regards, Murray

[Gary Richardson]

If you are concerned that it may be a virus, post a HijackThis log here and I'll have a quick look at it for you.

Download HJTInstall.exe to your Desktop.

• Doubleclick HJTInstall.exe to install it.
• By default it will install to C:\Program Files\Trend Micro\HijackThis .
• Click on Install.
• It will create a HijackThis icon on the desktop.
• Once installed, it will launch Hijackthis.
• Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
• Copy/Paste the log to your next reply please.
• Don't use the Analyse This button, its findings are dangerous if misinterpreted.
• Don't have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.

[Syd]

Gary you're a star. I have done a Hijackthis and, at first glance I could only find one entry that I wasn't sure about ALCMTR.EXE but on further investigation found out that it had something to do with Realtek. There is a lot of unecessary stuff there but it doesn't look like there is anything bad (to my untrained eye that is - hopefully you will be able to spot something though)! I'd love to get rid of the unecessary stuff but am a bit nervous that something will go wrong. Just to let you know this notebook is a popular Taiwanese make called Asus. Interestingly, the Asus Live Update programme does exactly the same thing as Photoshop ...it uses up all the computer memory. In fact the problem started with this programme.

Thanks for checking this out for me Gary. I really appreciate it.

Sincerely Syd

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 下午 11:00:49, on 2007/9/22
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\AsGHost.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
c:\WINDOWS\system32\IFXSPMGT.exe
c:\WINDOWS\system32\IFXTCS.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
c:\Program Files\Infineon\Security Platform Software\PSDsrvc.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
c:\Program Files\Infineon\Security Platform Software\PSDrt.exe
c:\Program Files\Infineon\Security Platform Software\SpTna.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\ATK0100\HControl.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Program Files\PowerForPhone\PowerForPhone\PowerForPhone.exe
C:\Program Files\ASUS\Splendid\ACMON.exe
C:\Program Files\Wireless Console 2\wcourier.exe
C:\Program Files\ASUS\ATK Media\DMEDIA.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\system32\ACEngSvr.exe
C:\Program Files\ASUS\Net4Switch\Net4Switch.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Safari\Safari.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: ASUS Security Protect Manager - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - c:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ItIEAddIn.dll
O3 - Toolbar: Dr.eye WebPage Translation - {92B255FE-94E2-4BCA-958D-3926CE38913F} - C:\PROGRA~1\Inventec\Dreye\DreyeMT\DREYEI~1.DLL
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [PowerForPhone] C:\Program Files\PowerForPhone\PowerForPhone\PowerForPhone.exe
O4 - HKLM\..\Run: [ASUS Live Update] C:\Program Files\ASUS\ASUS Live Update\ALU.exe
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe c:\PROGRA~1\ASUSSE~1\ASUSSE~1\Bin\ASTSVCC.dll,RegisterModule
O4 - HKLM\..\Run: [ACMON] C:\Program Files\ASUS\Splendid\ACMON.exe
O4 - HKLM\..\Run: [Wireless Console 2] C:\Program Files\Wireless Console 2\wcourier.exe
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMEDIA.EXE
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ABLKSR] C:\WINDOWS\ABLKSR\ABLKSR.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Power_Gear] C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [Net4Switch] C:\Program Files\ASUS\Net4Switch\Net4Switch.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: MultiFrame.lnk = ?
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: Lookup on Merriam Webster - file://C:\Program Files\ieSpell\Merriam Webster.HTM
O8 - Extra context menu item: Lookup on Wikipedia - file://C:\Program Files\ieSpell\wikipedia.HTM
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java 主控台 - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.com/SnapfishActivia.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/re...s/MSNPUpld.cab
O20 - AppInit_DLLs: APSHook.dll C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: OneCard - c:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWLNPkg.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Security Platform Management Service (IFXSpMgtSrv) - Infineon Technologies AG - c:\WINDOWS\system32\IFXSPMGT.exe
O23 - Service: Trusted Platform Core Service (IFXTCS) - Infineon Technologies AG - c:\WINDOWS\system32\IFXTCS.exe
O23 - Service: iPod 服務 (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Personal Secure Drive Service (PersonalSecureDriveService) - Infineon Technologies AG - c:\Program Files\Infineon\Security Platform Software\PSDsrvc.EXE
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe

--
End of file - 10973 bytes

[Gary Richardson]

Hi Syd,

OK your log looks clear.

Here's the dope on Alcmtr.exe in a strict sense it is Spyware, but it's not a Malicious one, just Realtek being nosey.

Name: [alcmtr]
Status: X
File: ALCMTR.EXE

Realtek AC97 Audio - Event Monitor. Sypware file used surreptitiously monitor one's actions. It is not a sinister one like remote control programs but it is being used by Realtek to gather data about customers
http://www.castlecops.com/startuplist-5306.html

If you'd rather they didn't get that information.

Run a scan with HJT and when finished check the following items (if found).

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

Now close all open windows and click Fix Checked to remove them.

This won't remove any files or anything that would affect Realtek, it will just stop that particular process from loading at startup.

If you want to find out and disable programmes that are unnecessary to run at Startup, try using Startuplite. (Details on Webpage linked below).

http://www.malwarebytes.org/startuplite.php

If you need me to go through your log to give you a bit more info on any unnecessary startup items let me know and I'll be happy to do so.

[Syd]

Thanks for your help Gary. Photoshop is still doing the same thing though. I am going to take the computer back to the place I bought it as it is not only Photoshop but also the Laptop Update Programme that is doing the same thing. It is still under guarantee so they will have to sort it out.

Thanks for the link to startuplite. I will check it out.

yours sincerely Syd

[Gary Richardson]

You're welcome Syd. If it's still under warranty it's always best to have the dealer/manufacturer sort the problem.

Just make sure you've backed up all your programmes, pics and other personal stuff before you take it in, because pro shops have a pre-disposition towards re-formatting and re-installing to cure all problems.

[Syd]

Gary, that last comment of yours has got me worried. Last time I had a virus on my old computer they did reformat everything and I had to reload all my software and somehow the engineer switched my C: and D: drives around so that my D: drive became the root drive. That would have been fine except that the D: drive was smaller than the C: drive and when it got full I had to keep on moving stuff from D: to C:. It was a real pain in the butt.

Anyway I remembered in an old post you had instructed me to download Kaspersky and do and online scan. I did and it has come up with one virus but because it is the free online scan version I can't remove it. I already have AVG on my computer and it hasn't picked anything up.

Is it okay if I post the Kaspersky Report here? Last time, I remember you got me to download KILLBox! to remove the infected file. To be honest I can't work out what is infected and what is not.

Syd
KASPERSKY ONLINE SCANNER REPORT
Monday, September 24, 2007 7:49:34 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.1
Kaspersky Anti-Virus database last update: 24/09/2007
Kaspersky Anti-Virus database records: 422846


Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
C:\
D:\
E:\

Scan Statistics
Total number of scanned objects 69434
Number of viruses found 1
Number of infected objects 1
Number of suspicious objects 0
Duration of the scan process 00:38:52

Infected Object Name Virus Name Last Action
C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\Media Ce.evt Object is locked skipped

C:\WINDOWS\system32\config\ASUS Sec.evt Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\DEFAULT Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped

C:\WINDOWS\system32\config\SYSTEM Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\wiaservc.log Object is locked skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{89AAA50F-1D42-4C23-B673-A9DBE5AEEC85}.crmlog Object is locked skipped

C:\WINDOWS\ModemLog_Motorola SM56 Speakerphone Modem.txt Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

C:\WINDOWS\Downloaded Program Files\popcaploader.dll Infected: not-a-virusownloader.Win32.PopCap.b skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

C:\WINDOWS\ModemLog_Communications cable between two computers.txt Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\ehRecvr.log Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped

C:\Documents and Settings\User\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\User\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\User\Local Settings\History\History.IE5\MSHist012007092420070925\index.dat Object is locked skipped

C:\Documents and Settings\User\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\User\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\User\UserData\index.dat Object is locked skipped

C:\Documents and Settings\User\ntuser.dat Object is locked skipped

C:\Program Files\Asus\Net4Switch\Resource.bin Object is locked skipped

C:\System Volume Information\_restore{6DF11C21-6E77-4B11-A10A-564E8D6E3602}\RP127\change.log Object is locked skipped

Scan process completed.

[Gary Richardson]

Hi Syd,

You've got a file lurking on your box that would be better removed. Not likely to be the source of your problem I wouldn't think (it's an ad loader), but I'd remove it anyway.

OTMoveIt is my new tool of preference for removing things.

Download OTMoveIt by OldTimer to your Desktop.

• Double click OTMoveIt.exe to launch it.
• Copy/Paste the contents of the box below into the left hand pane of OTMoveIt.

C:\WINDOWS\Downloaded Program Files\popcaploader.dll

• Click the Move It button.
• The list will be processed and the results will appear in the right hand pane.
• If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.
• When finished click Exit to exit the programme.
• A log C:\_OTMoveIt\MovedFiles\mmddyyyy_hhmmss.log will be created (where mmddyyyy_hhmmss are numbers giving date and time the log was created).
• Post the log back here please.

[Syd]

Thanks Gary. Done. I know where that came from. Popcap online games. Ever played Zuma. It's addictive. I liked it so much I got the full version (about 3 or 4 years ago now). Haven't got it on the new computer but often go to there site to check out their new games.


Really would prefer to sort this problem out myself so have downloaded a free trial version of Tuneup Utilities and am busy doing registry defrags and all sorts of things that you are probably going to get gray hairs over and scold me about. But don't worry: it comes with a rescue center There is nothing I can do that can't be put back together again.

And now worryingly my Zonealarm just wouldn't work and I had to download and install a clean version. Don't know why that would happen.

I have even tried System Restore (back to before I noticed things were wrong) but that didn't do anything.

Now as a last resort I am going to uninstall and reinstall Photoshop. But I will wait and see what you say first.

Thanks Gary and here is the report:\

C:\WINDOWS\Downloaded Program Files\popcaploader.dll unregistered successfully.
C:\WINDOWS\Downloaded Program Files\popcaploader.dll moved successfully.

Created on 09/24/2007 23:38:29

Syd

[Gary Richardson]

OK, first lets get rid of OTMoveIt, it's a very powerful (and therefore dangerous) tool, used wrongly it can do a whole lot of damage, removing system files and folders just as easily as it does others.

• Double click OTMoveIt.exe to launch the programme.
• Click on the CleanUp! button.
• OTMoveIt will download a list from the Internet, if your firewall or other defensive programmes alerts you, allow it access.
• You will be prompted to allow the clean up procedure, click Yes
• When finished exit out of OTMoveIt
• Now delete OTMoveIt.exe (if present).

Lets see if your computer has logged any events that might explain your recent problems.

• Right click on My Computer and select Manage. This will open the Computer Management window.
• In the left pane, click on the + sign beside System Tools to expand it.
• Click on the + sign beside Event Viewer to expand it.
• Click on Application
  • Look for any Error icons in the right pane (white cross on red background).
  • If there are any that are repetitive.
    • Double click on one of them to open the Event Properties window.
    • Click the copy button (below the down arrow on the upper right hand side) to copy this data to your clipboard.
    • Paste to a Notepad file.
• Click on System
  • Look for any Error icons in the right pane (white cross on red background).
  • If there are any that are repetitive.
    • Double click on one of them to open the Event Properties window.
    • Click the copy button (below the down arrow on the upper right hand side) to copy this data to your clipboard.
    • Paste to the Notepad file.
• Post the details of the Notepad file back here please.

No need to go back too far, if the problem is persistent it should be easy to see, if it isn't we'll have to look elsewhere.

[Syd]

Thanks so much Gary. I really appreciate it. I couldn't find OT move it to delete. It seems it doesn't exactly install on your computer. It just runs. It did create a folde on my laptop but no executable files.

Here are the Application and System logs. There were so many to be honest that I just picked the repeated ones as you suggested.

Syd
事件類型: 錯誤
事件來源: Application Error
事件類別目錄: 無
事件識別碼: 1000
日期: 2007/9/24
時間: 下午 06:53:34
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
失敗的應用程式 dict.exe，版本 3.1.1000.428，失敗的模組 dict.exe，版本 3.1.1000.428，錯誤位址 0x00001ade。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
資料:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 64 69 63 ure dic
0018: 74 2e 65 78 65 20 33 2e t.exe 3.
0020: 31 2e 31 30 30 30 2e 34 1.1000.4
0028: 32 38 20 69 6e 20 64 69 28 in di
0030: 63 74 2e 65 78 65 20 33 ct.exe 3
0038: 2e 31 2e 31 30 30 30 2e .1.1000.
0040: 34 32 38 20 61 74 20 6f 428 at o
0048: 66 66 73 65 74 20 30 30 ffset 00
0050: 30 30 31 61 64 65 0d 0a 001ade..
事件類型: 錯誤
事件來源: Application Error
事件類別目錄: 無
事件識別碼: 1000
日期: 2007/9/24
時間: 上午 10:38:36
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
失敗的應用程式 dict.exe，版本 3.1.1000.428，失敗的模組 dict.exe，版本 3.1.1000.428，錯誤位址 0x00001ade。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
資料:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 64 69 63 ure dic
0018: 74 2e 65 78 65 20 33 2e t.exe 3.
0020: 31 2e 31 30 30 30 2e 34 1.1000.4
0028: 32 38 20 69 6e 20 64 69 28 in di
0030: 63 74 2e 65 78 65 20 33 ct.exe 3
0038: 2e 31 2e 31 30 30 30 2e .1.1000.
0040: 34 32 38 20 61 74 20 6f 428 at o
0048: 66 66 73 65 74 20 30 30 ffset 00
0050: 30 30 31 61 64 65 0d 0a 001ade..事件類型: 錯誤
事件來源: Application Hang
事件類別目錄: (101)
事件識別碼: 1002
日期: 2007/9/19
時間: 下午 02:18:09
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
無回應的應用程式 Safari.exe，版本 3.522.15.5。無回應的模組 hungapp 版本 0.0.0.0。無回應的位址 0x00000000。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
資料:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 53 61 66 61 72 69 Safari
0018: 2e 65 78 65 20 33 2e 35 .exe 3.5
0020: 32 32 2e 31 35 2e 35 20 22.15.5
0028: 69 6e 20 68 75 6e 67 61 in hunga
0030: 70 70 20 30 2e 30 2e 30 pp 0.0.0
0038: 2e 30 20 61 74 20 6f 66 .0 at of
0040: 66 73 65 74 20 30 30 30 fset 000
0048: 30 30 30 30 30 00000 事件類型: 錯誤
事件來源: Application Error
事件類別目錄: 無
事件識別碼: 1000
日期: 2007/9/16
時間: 下午 12:33:28
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
失敗的應用程式 iexplore.exe，版本 6.0.2900.2180，失敗的模組 unknown，版本 0.0.0.0，錯誤位址 0x0608fd2d。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
資料:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 69 65 78 ure iex
0018: 70 6c 6f 72 65 2e 65 78 plore.ex
0020: 65 20 36 2e 30 2e 32 39 e 6.0.29
0028: 30 30 2e 32 31 38 30 20 00.2180
0030: 69 6e 20 75 6e 6b 6e 6f in unkno
0038: 77 6e 20 30 2e 30 2e 30 wn 0.0.0
0040: 2e 30 20 61 74 20 6f 66 .0 at of
0048: 66 73 65 74 20 30 36 30 fset 060
0050: 38 66 64 32 64 0d 0a 8fd2d.. 事件類型: 錯誤
事件來源: Application Error
事件類別目錄: 無
事件識別碼: 1000
日期: 2007/9/14
時間: 下午 10:08:44
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
失敗的應用程式 photoshop.exe，版本 9.0.2.0，失敗的模組 photoshop.exe，版本 9.0.2.0，錯誤位址 0x000139fa。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
資料:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 70 68 6f ure pho
0018: 74 6f 73 68 6f 70 2e 65 toshop.e
0020: 78 65 20 39 2e 30 2e 32 xe 9.0.2
0028: 2e 30 20 69 6e 20 70 68 .0 in ph
0030: 6f 74 6f 73 68 6f 70 2e otoshop.
0038: 65 78 65 20 39 2e 30 2e exe 9.0.
0040: 32 2e 30 20 61 74 20 6f 2.0 at o
0048: 66 66 73 65 74 20 30 30 ffset 00
0050: 30 31 33 39 66 61 0d 0a 0139fa..事件類型: 錯誤
事件來源: Application Hang
事件類別目錄: (101)
事件識別碼: 1002
日期: 2007/9/12
時間: 下午 10:19:49
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
無回應的應用程式 notepad.exe，版本 5.1.2600.2180。無回應的模組 hungapp 版本 0.0.0.0。無回應的位址 0x00000000。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
資料:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 6e 6f 74 65 70 61 notepa
0018: 64 2e 65 78 65 20 35 2e d.exe 5.
0020: 31 2e 32 36 30 30 2e 32 1.2600.2
0028: 31 38 30 20 69 6e 20 68 180 in h
0030: 75 6e 67 61 70 70 20 30 ungapp 0
0038: 2e 30 2e 30 2e 30 20 61 .0.0.0 a
0040: 74 20 6f 66 66 73 65 74 t offset
0048: 20 30 30 30 30 30 30 30 0000000
0050: 30 0 事件類型: 錯誤
事件來源: Application Hang
事件類別目錄: (101)
事件識別碼: 1002
日期: 2007/9/3
時間: 下午 11:13:04
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
無回應的應用程式 wmplayer.exe，版本 11.0.5721.5145。無回應的模組 hungapp 版本 0.0.0.0。無回應的位址 0x00000000。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
資料:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 77 6d 70 6c 61 79 wmplay
0018: 65 72 2e 65 78 65 20 31 er.exe 1
0020: 31 2e 30 2e 35 37 32 31 1.0.5721
0028: 2e 35 31 34 35 20 69 6e .5145 in
0030: 20 68 75 6e 67 61 70 70 hungapp
0038: 20 30 2e 30 2e 30 2e 30 0.0.0.0
0040: 20 61 74 20 6f 66 66 73 at offs
0048: 65 74 20 30 30 30 30 30 et 00000
0050: 30 30 30 000 事件類型: 錯誤
事件來源: Application Error
事件類別目錄: (100)
事件識別碼: 1004
日期: 2007/8/26
時間: 下午 07:41:07
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
失敗的應用程式 dllhost.exe，版本 5.1.2600.2180，失敗的模組 unknown，版本 0.0.0.0，錯誤位址 0x00f00de0。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
資料:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 64 6c 6c ure dll
0018: 68 6f 73 74 2e 65 78 65 host.exe
0020: 20 35 2e 31 2e 32 36 30 5.1.260
0028: 30 2e 32 31 38 30 20 69 0.2180 i
0030: 6e 20 75 6e 6b 6e 6f 77 n unknow
0038: 6e 20 30 2e 30 2e 30 2e n 0.0.0.
0040: 30 20 61 74 20 6f 66 66 0 at off
0048: 73 65 74 20 30 30 66 30 set 00f0
0050: 30 64 65 30 0de0
事件類型: 錯誤
事件來源: Application Hang
事件類別目錄: (101)
事件識別碼: 1002
日期: 2007/8/26
時間: 下午 04:09:05
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
無回應的應用程式 Photoshop.exe，版本 9.0.2.0。無回應的模組 hungapp 版本 0.0.0.0。無回應的位址 0x00000000。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
資料:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 50 68 6f 74 6f 73 Photos
0018: 68 6f 70 2e 65 78 65 20 hop.exe
0020: 39 2e 30 2e 32 2e 30 20 9.0.2.0
0028: 69 6e 20 68 75 6e 67 61 in hunga
0030: 70 70 20 30 2e 30 2e 30 pp 0.0.0
0038: 2e 30 20 61 74 20 6f 66 .0 at of
0040: 66 73 65 74 20 30 30 30 fset 000
0048: 30 30 30 30 30 00000
事件類型: 錯誤
事件來源: Application Error
事件類別目錄: 無
事件識別碼: 1000
日期: 2007/8/21
時間: 下午 12:24:31
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
失敗的應用程式 safari.exe，版本 3.522.15.5，失敗的模組 coregraphics.dll，版本 1.0.22.0，錯誤位址 0x00028b88。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
資料:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 73 61 66 ure saf
0018: 61 72 69 2e 65 78 65 20 ari.exe
0020: 33 2e 35 32 32 2e 31 35 3.522.15
0028: 2e 35 20 69 6e 20 63 6f .5 in co
0030: 72 65 67 72 61 70 68 69 regraphi
0038: 63 73 2e 64 6c 6c 20 31 cs.dll 1
0040: 2e 30 2e 32 32 2e 30 20 .0.22.0
0048: 61 74 20 6f 66 66 73 65 at offse
0050: 74 20 30 30 30 32 38 62 t 00028b
0058: 38 38 0d 0a 88..
事件類型: 錯誤
事件來源: Application Hang
事件類別目錄: (101)
事件識別碼: 1002
日期: 2007/8/20
時間: 上午 12:26:40
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
無回應的應用程式 explorer.exe，版本 6.0.2900.3156。無回應的模組 hungapp 版本 0.0.0.0。無回應的位址 0x00000000。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
資料:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 65 78 70 6c 6f 72 explor
0018: 65 72 2e 65 78 65 20 36 er.exe 6
0020: 2e 30 2e 32 39 30 30 2e .0.2900.
0028: 33 31 35 36 20 69 6e 20 3156 in
0030: 68 75 6e 67 61 70 70 20 hungapp
0038: 30 2e 30 2e 30 2e 30 20 0.0.0.0
0040: 61 74 20 6f 66 66 73 65 at offse
0048: 74 20 30 30 30 30 30 30 t 000000
0050: 30 30 00
事件類型: 錯誤
事件來源: Application Hang
事件類別目錄: (101)
事件識別碼: 1002
日期: 2007/8/19
時間: 下午 09:44:19
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
無回應的應用程式 RAWSupport.exe，版本 1.1.50.0。無回應的模組 hungapp 版本 0.0.0.0。無回應的位址 0x00000000。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
資料:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 52 41 57 53 75 70 RAWSup
0018: 70 6f 72 74 2e 65 78 65 port.exe
0020: 20 31 2e 31 2e 35 30 2e 1.1.50.
0028: 30 20 69 6e 20 68 75 6e 0 in hun
0030: 67 61 70 70 20 30 2e 30 gapp 0.0
0038: 2e 30 2e 30 20 61 74 20 .0.0 at
0040: 6f 66 66 73 65 74 20 30 offset 0
0048: 30 30 30 30 30 30 30 0000000

事件類型: 錯誤
事件來源: Application Error
事件類別目錄: 無
事件識別碼: 1000
日期: 2007/8/18
時間: 下午 11:11:53
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
失敗的應用程式 net4switch.exe，版本 1.0.0.1，失敗的模組 ipswcore.dll，版本 0.0.0.0，錯誤位址 0x00016fa1。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
資料:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 6e 65 74 ure net
0018: 34 73 77 69 74 63 68 2e 4switch.
0020: 65 78 65 20 31 2e 30 2e exe 1.0.
0028: 30 2e 31 20 69 6e 20 69 0.1 in i
0030: 70 73 77 63 6f 72 65 2e pswcore.
0038: 64 6c 6c 20 30 2e 30 2e dll 0.0.
0040: 30 2e 30 20 61 74 20 6f 0.0 at o
0048: 66 66 73 65 74 20 30 30 ffset 00
0050: 30 31 36 66 61 31 0d 0a 016fa1..
事件類型: 錯誤
事件來源: Application Error
事件類別目錄: 無
事件識別碼: 1000
日期: 2007/8/14
時間: 下午 08:59:19
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
失敗的應用程式 itunes.exe，版本 7.3.1.3，失敗的模組 itunes.exe，版本 7.3.1.3，錯誤位址 0x001123eb。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
資料:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 69 74 75 ure itu
0018: 6e 65 73 2e 65 78 65 20 nes.exe
0020: 37 2e 33 2e 31 2e 33 20 7.3.1.3
0028: 69 6e 20 69 74 75 6e 65 in itune
0030: 73 2e 65 78 65 20 37 2e s.exe 7.
0038: 33 2e 31 2e 33 20 61 74 3.1.3 at
0040: 20 6f 66 66 73 65 74 20 offset
0048: 30 30 31 31 32 33 65 62 001123eb
0050: 0d 0a ..
事件類型: 錯誤
事件來源: Application Hang
事件類別目錄: (101)
事件識別碼: 1002
日期: 2007/8/11
時間: 下午 08:25:57
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
無回應的應用程式 Safari.exe，版本 3.522.15.5。無回應的模組 hungapp 版本 0.0.0.0。無回應的位址 0x00000000。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
資料:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 53 61 66 61 72 69 Safari
0018: 2e 65 78 65 20 33 2e 35 .exe 3.5
0020: 32 32 2e 31 35 2e 35 20 22.15.5
0028: 69 6e 20 68 75 6e 67 61 in hunga
0030: 70 70 20 30 2e 30 2e 30 pp 0.0.0
0038: 2e 30 20 61 74 20 6f 66 .0 at of
0040: 66 73 65 74 20 30 30 30 fset 000
0048: 30 30 30 30 30 00000
事件類型: 錯誤
事件來源: Application Error
事件類別目錄: 無
事件識別碼: 1000
日期: 2007/8/6
時間: 上午 10:57:13
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
失敗的應用程式 photoshop.exe，版本 9.0.2.0，失敗的模組 lightingeffects.8bf，版本 9.0.0.0，錯誤位址 0x0000c0cd。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
資料:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 70 68 6f ure pho
0018: 74 6f 73 68 6f 70 2e 65 toshop.e
0020: 78 65 20 39 2e 30 2e 32 xe 9.0.2
0028: 2e 30 20 69 6e 20 6c 69 .0 in li
0030: 67 68 74 69 6e 67 65 66 ghtingef
0038: 66 65 63 74 73 2e 38 62 fects.8b
0040: 66 20 39 2e 30 2e 30 2e f 9.0.0.
0048: 30 20 61 74 20 6f 66 66 0 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 63 30 63 64 0d 0a c0cd.. 事件類型: 錯誤
事件來源: Application Error
事件類別目錄: 無
事件識別碼: 1000
日期: 2007/8/4
時間: 下午 10:40:01
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
失敗的應用程式 iexplore.exe，版本 6.0.2900.2180，失敗的模組 mshtml.dll，版本 6.0.2900.3132，錯誤位址 0x0006959d。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
資料:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 69 65 78 ure iex
0018: 70 6c 6f 72 65 2e 65 78 plore.ex
0020: 65 20 36 2e 30 2e 32 39 e 6.0.29
0028: 30 30 2e 32 31 38 30 20 00.2180
0030: 69 6e 20 6d 73 68 74 6d in mshtm
0038: 6c 2e 64 6c 6c 20 36 2e l.dll 6.
0040: 30 2e 32 39 30 30 2e 33 0.2900.3
0048: 31 33 32 20 61 74 20 6f 132 at o
0050: 66 66 73 65 74 20 30 30 ffset 00
0058: 30 36 39 35 39 64 0d 0a 06959d..
事件類型: 錯誤
事件來源: Application Error
事件類別目錄: 無
事件識別碼: 1000
日期: 2007/8/3
時間: 下午 01:06:58
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
失敗的應用程式 net4switch.exe，版本 1.0.0.1，失敗的模組 ipswcore.dll，版本 0.0.0.0，錯誤位址 0x00016fa1。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
資料:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 6e 65 74 ure net
0018: 34 73 77 69 74 63 68 2e 4switch.
0020: 65 78 65 20 31 2e 30 2e exe 1.0.
0028: 30 2e 31 20 69 6e 20 69 0.1 in i
0030: 70 73 77 63 6f 72 65 2e pswcore.
0038: 64 6c 6c 20 30 2e 30 2e dll 0.0.
0040: 30 2e 30 20 61 74 20 6f 0.0 at o
0048: 66 66 73 65 74 20 30 30 ffset 00
0050: 30 31 36 66 61 31 0d 0a 016fa1..
事件類型: 錯誤
事件來源: Application Error
事件類別目錄: 無
事件識別碼: 1000
日期: 2007/7/29
時間: 下午 07:30:29
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
失敗的應用程式 net4switch.exe，版本 1.0.0.1，失敗的模組 ipswcore.dll，版本 0.0.0.0，錯誤位址 0x00016fa1。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
資料:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 6e 65 74 ure net
0018: 34 73 77 69 74 63 68 2e 4switch.
0020: 65 78 65 20 31 2e 30 2e exe 1.0.
0028: 30 2e 31 20 69 6e 20 69 0.1 in i
0030: 70 73 77 63 6f 72 65 2e pswcore.
0038: 64 6c 6c 20 30 2e 30 2e dll 0.0.
0040: 30 2e 30 20 61 74 20 6f 0.0 at o
0048: 66 66 73 65 74 20 30 30 ffset 00
0050: 30 31 36 66 61 31 0d 0a 016fa1..
事件類型: 錯誤
事件來源: Application Error
事件類別目錄: (100)
事件識別碼: 1004
日期: 2007/7/29
時間: 下午 07:29:12
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
失敗的應用程式 dllhost.exe，版本 5.1.2600.2180，失敗的模組 unknown，版本 0.0.0.0，錯誤位址 0x011f0de0。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
資料:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 64 6c 6c ure dll
0018: 68 6f 73 74 2e 65 78 65 host.exe
0020: 20 35 2e 31 2e 32 36 30 5.1.260
0028: 30 2e 32 31 38 30 20 69 0.2180 i
0030: 6e 20 75 6e 6b 6e 6f 77 n unknow
0038: 6e 20 30 2e 30 2e 30 2e n 0.0.0.
0040: 30 20 61 74 20 6f 66 66 0 at off
0048: 73 65 74 20 30 31 31 66 set 011f
0050: 30 64 65 30 0de0
事件類型: 錯誤
事件來源: Application Error
事件類別目錄: (100)
事件識別碼: 1000
日期: 2007/7/29
時間: 上午 09:00:17
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
失敗的應用程式 dllhost.exe，版本 5.1.2600.2180，失敗的模組 unknown，版本 0.0.0.0，錯誤位址 0x011f0de0。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
資料:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 64 6c 6c ure dll
0018: 68 6f 73 74 2e 65 78 65 host.exe
0020: 20 35 2e 31 2e 32 36 30 5.1.260
0028: 30 2e 32 31 38 30 20 69 0.2180 i
0030: 6e 20 75 6e 6b 6e 6f 77 n unknow
0038: 6e 20 30 2e 30 2e 30 2e n 0.0.0.
0040: 30 20 61 74 20 6f 66 66 0 at off
0048: 73 65 74 20 30 31 31 66 set 011f
0050: 30 64 65 30 0de0
事件類型: 錯誤
事件來源: Application Error
事件類別目錄: 無
事件識別碼: 1000
日期: 2007/7/26
時間: 下午 02:40:58
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
失敗的應用程式 net4switch.exe，版本 1.0.0.1，失敗的模組 ipswcore.dll，版本 0.0.0.0，錯誤位址 0x00016fa1。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
資料:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 6e 65 74 ure net
0018: 34 73 77 69 74 63 68 2e 4switch.
0020: 65 78 65 20 31 2e 30 2e exe 1.0.
0028: 30 2e 31 20 69 6e 20 69 0.1 in i
0030: 70 73 77 63 6f 72 65 2e pswcore.
0038: 64 6c 6c 20 30 2e 30 2e dll 0.0.
0040: 30 2e 30 20 61 74 20 6f 0.0 at o
0048: 66 66 73 65 74 20 30 30 ffset 00
0050: 30 31 36 66 61 31 0d 0a 016fa1..
事件類型: 錯誤
事件來源: Application Error
事件類別目錄: (100)
事件識別碼: 1004
日期: 2007/7/25
時間: 上午 09:34:10
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
失敗的應用程式 dllhost.exe，版本 5.1.2600.2180，失敗的模組 unknown，版本 0.0.0.0，錯誤位址 0x01160de0。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
資料:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 64 6c 6c ure dll
0018: 68 6f 73 74 2e 65 78 65 host.exe
0020: 20 35 2e 31 2e 32 36 30 5.1.260
0028: 30 2e 32 31 38 30 20 69 0.2180 i
0030: 6e 20 75 6e 6b 6e 6f 77 n unknow
0038: 6e 20 30 2e 30 2e 30 2e n 0.0.0.
0040: 30 20 61 74 20 6f 66 66 0 at off
0048: 73 65 74 20 30 31 31 36 set 0116
0050: 30 64 65 30 0de0
事件類型: 錯誤
事件來源: Dhcp
事件類別目錄: 無
事件識別碼: 1001
日期: 2007/9/25
時間: 上午 07:38:50
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
DHCP 伺服器並未將網路位址指派給電腦在 網路位址 0018DE731969 的網路卡。發生下列的錯誤:
操作被使用者取消。 。 您的電腦將會繼續嘗試從網路位址伺服器 (DHCP) 取得一個位址。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
資料:
0000: c7 04 00 00 Ç...
事件類型: 錯誤
事件來源: MRxSmb
事件類別目錄: 無
事件識別碼: 8003
日期: 2007/9/25
時間: 上午 03:40:37
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
主瀏覽器從電腦 899998-PC 收到 認為它是傳輸 NetBT_Tcpip_{0398615B-9334-4C94 網域主瀏覽器的伺服器宣告。 主瀏覽器已中止或已強制選擇。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
資料:
0000: 00 00 00 00 03 00 4e 00 ......N.
0008: 00 00 00 00 43 1f 00 c0 ....C..À
0010: 00 00 00 00 00 00 00 00 ........
0018: 03 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
事件類型: 錯誤
事件來源: MRxSmb
事件類別目錄: 無
事件識別碼: 8003
日期: 2007/9/25
時間: 上午 02:34:51
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
主瀏覽器從電腦 899998-PC 收到 認為它是傳輸 NetBT_Tcpip_{0398615B-9334-4C94 網域主瀏覽器的伺服器宣告。 主瀏覽器已中止或已強制選擇。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
資料:
0000: 00 00 00 00 03 00 4e 00 ......N.
0008: 00 00 00 00 43 1f 00 c0 ....C..À
0010: 00 00 00 00 00 00 00 00 ........
0018: 02 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

事件類型: 錯誤
事件來源: MRxSmb
事件類別目錄: 無
事件識別碼: 8003
日期: 2007/9/25
時間: 上午 01:19:45
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
主瀏覽器從電腦 899998-PC 收到 認為它是傳輸 NetBT_Tcpip_{0398615B-9334-4C94 網域主瀏覽器的伺服器宣告。 主瀏覽器已中止或已強制選擇。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
資料:
0000: 00 00 00 00 03 00 4e 00 ......N.
0008: 00 00 00 00 43 1f 00 c0 ....C..À
0010: 00 00 00 00 00 00 00 00 ........
0018: 01 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
事件類型: 錯誤
事件來源: MRxSmb
事件類別目錄: 無
事件識別碼: 8003
日期: 2007/9/25
時間: 上午 12:05:41
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
主瀏覽器從電腦 899998-PC 收到 認為它是傳輸 NetBT_Tcpip_{0398615B-9334-4C94 網域主瀏覽器的伺服器宣告。 主瀏覽器已中止或已強制選擇。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
資料:
0000: 00 00 00 00 03 00 4e 00 ......N.
0008: 00 00 00 00 43 1f 00 c0 ....C..À
0010: 00 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
事件類型: 錯誤
事件來源: MRxSmb
事件類別目錄: 無
事件識別碼: 8003
日期: 2007/9/25
時間: 上午 12:05:41
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
主瀏覽器從電腦 899998-PC 收到 認為它是傳輸 NetBT_Tcpip_{0398615B-9334-4C94 網域主瀏覽器的伺服器宣告。 主瀏覽器已中止或已強制選擇。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
資料:
0000: 00 00 00 00 03 00 4e 00 ......N.
0008: 00 00 00 00 43 1f 00 c0 ....C..À
0010: 00 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

事件類型: 錯誤
事件來源: Service Control Manager
事件類別目錄: 無
事件識別碼: 7034
日期: 2007/9/24
時間: 下午 11:08:54
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
NVIDIA Display Driver Service 服務意外地終止。已經發生 1 次。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
事件類型: 錯誤
事件來源: W32Time
事件類別目錄: 無
事件識別碼: 29
日期: 2007/9/8
時間: 上午 09:10:03
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
時間提供者 NtpClient 已經設定成從某些時間來源 取得時間，不過目前沒有可存取的時間來源， 將嘗試在 14 分內連絡上一個來源。 NTPCLIENT 沒有正確的時間來源。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
事件類型: 錯誤
事件來源: Dhcp
事件類別目錄: 無
事件識別碼: 1000
日期: 2007/9/7
時間: 下午 09:17:55
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
您的電腦已遺失它在網路位址為 0018DE731969 的網路卡上 IP 位址 192.168.30.17 的租用。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
事件類型: 錯誤
事件來源: Dhcp
事件類別目錄: 無
事件識別碼: 1000
日期: 2007/9/7
時間: 上午 07:41:18
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
您的電腦已遺失它在網路位址為 0018DE731969 的網路卡上 IP 位址 192.168.20.10 的租用。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
事件類型: 錯誤
事件來源: MRxSmb
事件類別目錄: 無
事件識別碼: 8003
日期: 2007/9/7
時間: 上午 12:05:24
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
主瀏覽器從電腦 WEI-YU-PC 收到 認為它是傳輸 NetBT_Tcpip_{0398615B-9334-4C94 網域主瀏覽器的伺服器宣告。 主瀏覽器已中止或已強制選擇。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
資料:
0000: 00 00 00 00 03 00 4e 00 ......N.
0008: 00 00 00 00 43 1f 00 c0 ....C..À
0010: 00 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
事件類型: 錯誤
事件來源: W32Time
事件類別目錄: 無
事件識別碼: 29
日期: 2007/9/6
時間: 下午 11:40:26
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
時間提供者 NtpClient 已經設定成從某些時間來源 取得時間，不過目前沒有可存取的時間來源， 將嘗試在 14 分內連絡上一個來源。 NTPCLIENT 沒有正確的時間來源。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
事件類型: 錯誤
事件來源: W32Time
事件類別目錄: 無
事件識別碼: 17
日期: 2007/9/6
時間: 下午 11:40:26
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
時間提供者 NtpClient: 手動的設定對等 'time.windows.com,0x1' 在進行 DNS 搜尋時 發生意外錯誤。 NtpClient 會在 15 分鐘內重新嘗試 DNS 搜尋。 錯誤是: 通訊端操作無法連線到主機。 (0x80072751)

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。

[Gary Richardson]

Hi Syd,

There's no clearly discernible pattern to pin things down, although you do seem to be having a lot of DNS (Domain Name Server) related problems. We can try re-setting that, but it will probably resolve nothing. (It's certainly not related to the Photoshop problems).

There are far more Events on your log than you should be expecting to see on a relatively new computer. My gut feeling on this is that you have a hardware problem and as your computer is still under warranty your dealer should deal with it.

Back up all your files and take your machine in.

In the meantime, if you want to reset your DNS server to see if it helps to stop those Events happening, do the following.

• Click Start > Connect to > Show all connections.
• Right click on your default connection, usually Local Area Connection for cable and dsl (or Dial-up Connection if you are using dial-up).
• Left click on Properties.
• Click the Networking tab.
• Double-click on the Internet Protocol (TCP/IP) item and select the radio dial that says Obtain DNS servers automatically.
• Press OK twice to get out of the properties screen and reboot if it asks. (That option might not be avaiable on some systems).

Next!

• Click Start > Run type cmd and hit OK.
• Type ipconfig /flushdns then hit enter, (Note: there is a space between ipconfig and /flushdns).
• Type exit hit enter.

There's a slim chance you can't access the internet after re-setting your DNS automatically, in which case follow the steps below in Green: ONLY IF YOU CAN'T CONNECT

• Select Start > Control Panel > Network and Internet Connections > Network Connections
• Right click your default connection, usually Local Area Connection (or Dial-up Connection if you are using dial-up).
• Click Properties.
• Click the Networking tab.
  • Under This connection uses the following items,
    • Select Internet Protocol (TCP/IP) and press the Properties button
    • Select the radio button that says Use the following DNS server addresses:
    • Enter the following IP address into the Preferred DNS Server box:
      • 208.67.222.222
    • Enter the following IP address into the Alternate DNS Server box:
      • 208.67.220.220
    • Click OK twice to exit out of the Properties box.
    • Reboot your computer.

[Syd]

Thanks Gary. Did what you suggested. Connects to the internet just fine. I think you are right though. I have tried everything I know. I reinstalled and that had no effect either. I think it is now time to back up and take it back to the shop.

Thanks for your help Gary.

Sincerely Syd

[Gary Richardson]

You're welcome Syd.

Good luck with the dealer.

[channi]

I found your forum when googling for 'photoshop uses all my memory', and read with interest the contributions of this thread. As it is 1 1/2 years later I wonder if there is anywhere a better solution than going back to the dealer. As this problem occurred to Syd exactly as it occurs now to myself (photoshop cs2) I assume it has happened to more people, and a real solution might be available. I am using photoshop for years, installed it many times, this never happened before. I have now reinstalled the creative suite2, which has solved a problem that appeared simultaneously in indesign. The photoshop memory black hole is still there.
As Syd described: Just start photoshop, and the memory use creeps up untill the system stalls as my 2Gig are used up.
I would like to avoid reinstalling my whole system, and losing (again) all my adobe preferences, having to reactivate again etc.

Your opininon is much appreciated

channi

[Gary Richardson]

Hi Channi,

It's only 3 months since I spoke to Syd about his problem, not 1½ years.

The best people to resolve this problem for you are Adobe.

My speciality is malware removal, and I merely checked Syd's machine for signs of any malicious programmes that might have been interfering with the normal running of Photoshop.

In his case there was no infection present, however in the course of our investigation it was found that his computer was recording an above average amount of "Events", which indicated that he was probably in the early stages of a hardware failure.

Although your symptoms are similar, this does not mean that your reason for failure is the same as Syd's.

Have you recently installed any new programmes, particularly any that are linked to Photoshop in any way? We are looking for installs around the time when your Photoshop problems started. If so, try uninstalling them and see if that resolves your problem.

If you think that you may have an infection, then by all means post me a HijackThis log and I'll look it over for you, but I reiterate, Adobe are the best source for a solution to your problem.