HELP! Photoshop is using all my RAM!

Syd · #1 09-21-2007, 09:25 AM

This is weird. It started two days ago and I can't seem to get to the bottom of it. When I open Photoshop and then open Task Manager and go to the Efficiency tab ( I think that is how you say it in English) I just watch as Photoshop steadily eats up all my RAM. And this is without even opening a file. It just starts using it up in 5mb increments until it is all gone and then everything jams up. I have 1.5 gigs of RAM and another 500megs on my video card and it hasn't been a problem up until now.

I went and shut everything down, even disconnected from the internet and opened Photoshop again but the same thing just happens. I Dumped Preferences and reset everything but that didn't help either. Photoshop is only set to use 55% of my RAM so I can't understand how this is happening. My Scratch Disk is set to the D drive which is empty.

Stange thing about it is, if you go to the Processes tab in Task Manager you will see Photoshop climb to its limit and then drop right down to 30 or 40 megs but in the Efficiency tab the computer is still maxed out and everything is jammed up or slowed down to a snails pace.

Anyone else ever experience this?

Syd

Xaran · #2 09-21-2007, 10:49 AM

I hate to say this but it really sounds like you have a virus on your computer.

If you do have anti virus software run a full system scan if you do not do a search for AVG Antivirus there is a free version for personal use.

Christine

mistermonday · #3 09-21-2007, 11:07 AM

Syd, Photoshop has been known to do some very strange things when its preference file gets corrupted. Before you go hunting for viruses I recommend that you reset the prefs by holding down the Ctrl+Alt+Shift while starting Photoshop. If it is strill doing it after you reset your prefs, then there is something else going on with other processes, services, or applications on your machine.
Regards, Murray

Gary Richardson · #4 09-22-2007, 02:25 AM

If you are concerned that it may be a virus, post a HijackThis log here and I'll have a quick look at it for you.

Download HJTInstall.exe to your Desktop.

Doubleclick HJTInstall.exe to install it.
By default it will install to C:\Program Files\Trend Micro\HijackThis .
Click on Install.
It will create a HijackThis icon on the desktop.
Once installed, it will launch Hijackthis.
Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
Copy/Paste the log to your next reply please.
Don't use the Analyse This button, its findings are dangerous if misinterpreted.
Don't have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.

Syd · #5 09-22-2007, 09:27 AM

Gary you're a star. I have done a Hijackthis and, at first glance I could only find one entry that I wasn't sure about ALCMTR.EXE but on further investigation found out that it had something to do with Realtek. There is a lot of unecessary stuff there but it doesn't look like there is anything bad (to my untrained eye that is - hopefully you will be able to spot something though)! I'd love to get rid of the unecessary stuff but am a bit nervous that something will go wrong. Just to let you know this notebook is a popular Taiwanese make called Asus. Interestingly, the Asus Live Update programme does exactly the same thing as Photoshop ...it uses up all the computer memory. In fact the problem started with this programme.

Thanks for checking this out for me Gary. I really appreciate it.

Sincerely Syd

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 下午 11:00:49, on 2007/9/22
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\AsGHost.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
c:\WINDOWS\system32\IFXSPMGT.exe
c:\WINDOWS\system32\IFXTCS.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
c:\Program Files\Infineon\Security Platform Software\PSDsrvc.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
c:\Program Files\Infineon\Security Platform Software\PSDrt.exe
c:\Program Files\Infineon\Security Platform Software\SpTna.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\ATK0100\HControl.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Program Files\PowerForPhone\PowerForPhone\PowerForPhone.exe
C:\Program Files\ASUS\Splendid\ACMON.exe
C:\Program Files\Wireless Console 2\wcourier.exe
C:\Program Files\ASUS\ATK Media\DMEDIA.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\system32\ACEngSvr.exe
C:\Program Files\ASUS\Net4Switch\Net4Switch.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Safari\Safari.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: ASUS Security Protect Manager - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - c:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ItIEAddIn.dll
O3 - Toolbar: Dr.eye WebPage Translation - {92B255FE-94E2-4BCA-958D-3926CE38913F} - C:\PROGRA~1\Inventec\Dreye\DreyeMT\DREYEI~1.DLL
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [PowerForPhone] C:\Program Files\PowerForPhone\PowerForPhone\PowerForPhone.exe
O4 - HKLM\..\Run: [ASUS Live Update] C:\Program Files\ASUS\ASUS Live Update\ALU.exe
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe c:\PROGRA~1\ASUSSE~1\ASUSSE~1\Bin\ASTSVCC.dll,RegisterModule
O4 - HKLM\..\Run: [ACMON] C:\Program Files\ASUS\Splendid\ACMON.exe
O4 - HKLM\..\Run: [Wireless Console 2] C:\Program Files\Wireless Console 2\wcourier.exe
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMEDIA.EXE
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ABLKSR] C:\WINDOWS\ABLKSR\ABLKSR.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Power_Gear] C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [Net4Switch] C:\Program Files\ASUS\Net4Switch\Net4Switch.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: MultiFrame.lnk = ?
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: Lookup on Merriam Webster - file://C:\Program Files\ieSpell\Merriam Webster.HTM
O8 - Extra context menu item: Lookup on Wikipedia - file://C:\Program Files\ieSpell\wikipedia.HTM
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java 主控台 - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.com/SnapfishActivia.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/re...s/MSNPUpld.cab
O20 - AppInit_DLLs: APSHook.dll C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: OneCard - c:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWLNPkg.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Security Platform Management Service (IFXSpMgtSrv) - Infineon Technologies AG - c:\WINDOWS\system32\IFXSPMGT.exe
O23 - Service: Trusted Platform Core Service (IFXTCS) - Infineon Technologies AG - c:\WINDOWS\system32\IFXTCS.exe
O23 - Service: iPod 服務 (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Personal Secure Drive Service (PersonalSecureDriveService) - Infineon Technologies AG - c:\Program Files\Infineon\Security Platform Software\PSDsrvc.EXE
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe

--
End of file - 10973 bytes

Gary Richardson · #6 09-23-2007, 02:09 AM

Hi Syd,

OK your log looks clear.

Here's the dope on Alcmtr.exe in a strict sense it is Spyware, but it's not a Malicious one, just Realtek being nosey.

Quote:

Name: [alcmtr]
Status: X
File: ALCMTR.EXE

Realtek AC97 Audio - Event Monitor. Sypware file used surreptitiously monitor one's actions. It is not a sinister one like remote control programs but it is being used by Realtek to gather data about customers
http://www.castlecops.com/startuplist-5306.html

If you'd rather they didn't get that information.

Quote:

Run a scan with HJT and when finished check the following items (if found).

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

Now close all open windows and click Fix Checked to remove them.

This won't remove any files or anything that would affect Realtek, it will just stop that particular process from loading at startup.

If you want to find out and disable programmes that are unnecessary to run at Startup, try using Startuplite. (Details on Webpage linked below).

http://www.malwarebytes.org/startuplite.php

If you need me to go through your log to give you a bit more info on any unnecessary startup items let me know and I'll be happy to do so.

Syd · #7 09-23-2007, 05:51 AM

Thanks for your help Gary. Photoshop is still doing the same thing though. I am going to take the computer back to the place I bought it as it is not only Photoshop but also the Laptop Update Programme that is doing the same thing. It is still under guarantee so they will have to sort it out.

Thanks for the link to startuplite. I will check it out.

yours sincerely Syd

Gary Richardson · #8 09-23-2007, 09:54 AM

You're welcome Syd. If it's still under warranty it's always best to have the dealer/manufacturer sort the problem.

Just make sure you've backed up all your programmes, pics and other personal stuff before you take it in, because pro shops have a pre-disposition towards re-formatting and re-installing to cure all problems.

Syd · #9 09-24-2007, 06:01 AM

Gary, that last comment of yours has got me worried. Last time I had a virus on my old computer they did reformat everything and I had to reload all my software and somehow the engineer switched my C: and D: drives around so that my D: drive became the root drive. That would have been fine except that the D: drive was smaller than the C: drive and when it got full I had to keep on moving stuff from D: to C:. It was a real pain in the butt.

Anyway I remembered in an old post you had instructed me to download Kaspersky and do and online scan. I did and it has come up with one virus but because it is the free online scan version I can't remove it. I already have AVG on my computer and it hasn't picked anything up.

Is it okay if I post the Kaspersky Report here? Last time, I remember you got me to download KILLBox! to remove the infected file. To be honest I can't work out what is infected and what is not.

Syd
KASPERSKY ONLINE SCANNER REPORT
Monday, September 24, 2007 7:49:34 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.1
Kaspersky Anti-Virus database last update: 24/09/2007
Kaspersky Anti-Virus database records: 422846

Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
C:\
D:\
E:\

Scan Statistics
Total number of scanned objects 69434
Number of viruses found 1
Number of infected objects 1
Number of suspicious objects 0
Duration of the scan process 00:38:52

Infected Object Name Virus Name Last Action
C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\Media Ce.evt Object is locked skipped

C:\WINDOWS\system32\config\ASUS Sec.evt Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\DEFAULT Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped

C:\WINDOWS\system32\config\SYSTEM Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\wiaservc.log Object is locked skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{89AAA50F-1D42-4C23-B673-A9DBE5AEEC85}.crmlog Object is locked skipped

C:\WINDOWS\ModemLog_Motorola SM56 Speakerphone Modem.txt Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

C:\WINDOWS\Downloaded Program Files\popcaploader.dll Infected: not-a-virus

ownloader.Win32.PopCap.b skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

C:\WINDOWS\ModemLog_Communications cable between two computers.txt Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\ehRecvr.log Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped

C:\Documents and Settings\User\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\User\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\User\Local Settings\History\History.IE5\MSHist012007092420070925\index.dat Object is locked skipped

C:\Documents and Settings\User\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\User\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\User\UserData\index.dat Object is locked skipped

C:\Documents and Settings\User\ntuser.dat Object is locked skipped

C:\Program Files\Asus\Net4Switch\Resource.bin Object is locked skipped

C:\System Volume Information\_restore{6DF11C21-6E77-4B11-A10A-564E8D6E3602}\RP127\change.log Object is locked skipped

Scan process completed.

Gary Richardson · #10 09-24-2007, 08:53 AM

Hi Syd,

You've got a file lurking on your box that would be better removed. Not likely to be the source of your problem I wouldn't think (it's an ad loader), but I'd remove it anyway.

OTMoveIt is my new tool of preference for removing things.

Download OTMoveIt by OldTimer to your Desktop.

Double click OTMoveIt.exe to launch it.
Copy/Paste the contents of the box below into the left hand pane of OTMoveIt.

Quote:

C:\WINDOWS\Downloaded Program Files\popcaploader.dll

Click the Move It button.
The list will be processed and the results will appear in the right hand pane.
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.
When finished click Exit to exit the programme.
A log C:\_OTMoveIt\MovedFiles\mmddyyyy_hhmmss.log will be created (where mmddyyyy_hhmmss are numbers giving date and time the log was created).
Post the log back here please.

Syd · #11 09-24-2007, 09:53 AM

Thanks Gary. Done. I know where that came from. Popcap online games. Ever played Zuma. It's addictive. I liked it so much I got the full version (about 3 or 4 years ago now). Haven't got it on the new computer but often go to there site to check out their new games.

Really would prefer to sort this problem out myself so have downloaded a free trial version of Tuneup Utilities and am busy doing registry defrags and all sorts of things that you are probably going to get gray hairs over and scold me about. But don't worry: it comes with a rescue center

There is nothing I can do that can't be put back together again.

And now worryingly my Zonealarm just wouldn't work and I had to download and install a clean version. Don't know why that would happen.

I have even tried System Restore (back to before I noticed things were wrong) but that didn't do anything.

Now as a last resort I am going to uninstall and reinstall Photoshop. But I will wait and see what you say first.

Thanks Gary and here is the report:\

C:\WINDOWS\Downloaded Program Files\popcaploader.dll unregistered successfully.
C:\WINDOWS\Downloaded Program Files\popcaploader.dll moved successfully.

Created on 09/24/2007 23:38:29

Syd

Gary Richardson · #12 09-24-2007, 02:49 PM

OK, first lets get rid of OTMoveIt, it's a very powerful (and therefore dangerous) tool, used wrongly it can do a whole lot of damage, removing system files and folders just as easily as it does others.

Double click OTMoveIt.exe to launch the programme.
Click on the CleanUp! button.
OTMoveIt will download a list from the Internet, if your firewall or other defensive programmes alerts you, allow it access.
You will be prompted to allow the clean up procedure, click Yes
When finished exit out of OTMoveIt
Now delete OTMoveIt.exe (if present).

Lets see if your computer has logged any events that might explain your recent problems.

Right click on My Computer and select Manage. This will open the Computer Management window.
In the left pane, click on the + sign beside System Tools to expand it.
Click on the + sign beside Event Viewer to expand it.
Click on Application
- Look for any Error icons in the right pane (white cross on red background).
- If there are any that are repetitive.
  - Double click on one of them to open the Event Properties window.
  - Click the copy button (below the down arrow on the upper right hand side) to copy this data to your clipboard.
  - Paste to a Notepad file.
Click on System
- Look for any Error icons in the right pane (white cross on red background).
- If there are any that are repetitive.
  - Double click on one of them to open the Event Properties window.
  - Click the copy button (below the down arrow on the upper right hand side) to copy this data to your clipboard.
  - Paste to the Notepad file.
Post the details of the Notepad file back here please.

No need to go back too far, if the problem is persistent it should be easy to see, if it isn't we'll have to look elsewhere.

Syd · #13 09-24-2007, 06:15 PM

Thanks so much Gary. I really appreciate it. I couldn't find OT move it to delete. It seems it doesn't exactly install on your computer. It just runs. It did create a folde on my laptop but no executable files.

Here are the Application and System logs. There were so many to be honest that I just picked the repeated ones as you suggested.

Syd
事件類型: 錯誤
事件來源: Application Error
事件類別目錄: 無
事件識別碼: 1000
日期: 2007/9/24
時間: 下午 06:53:34
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
失敗的應用程式 dict.exe，版本 3.1.1000.428，失敗的模組 dict.exe，版本 3.1.1000.428，錯誤位址 0x00001ade。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
資料:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 64 69 63 ure dic
0018: 74 2e 65 78 65 20 33 2e t.exe 3.
0020: 31 2e 31 30 30 30 2e 34 1.1000.4
0028: 32 38 20 69 6e 20 64 69 28 in di
0030: 63 74 2e 65 78 65 20 33 ct.exe 3
0038: 2e 31 2e 31 30 30 30 2e .1.1000.
0040: 34 32 38 20 61 74 20 6f 428 at o
0048: 66 66 73 65 74 20 30 30 ffset 00
0050: 30 30 31 61 64 65 0d 0a 001ade..
事件類型: 錯誤
事件來源: Application Error
事件類別目錄: 無
事件識別碼: 1000
日期: 2007/9/24
時間: 上午 10:38:36
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
失敗的應用程式 dict.exe，版本 3.1.1000.428，失敗的模組 dict.exe，版本 3.1.1000.428，錯誤位址 0x00001ade。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
資料:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 64 69 63 ure dic
0018: 74 2e 65 78 65 20 33 2e t.exe 3.
0020: 31 2e 31 30 30 30 2e 34 1.1000.4
0028: 32 38 20 69 6e 20 64 69 28 in di
0030: 63 74 2e 65 78 65 20 33 ct.exe 3
0038: 2e 31 2e 31 30 30 30 2e .1.1000.
0040: 34 32 38 20 61 74 20 6f 428 at o
0048: 66 66 73 65 74 20 30 30 ffset 00
0050: 30 30 31 61 64 65 0d 0a 001ade..事件類型: 錯誤
事件來源: Application Hang
事件類別目錄: (101)
事件識別碼: 1002
日期: 2007/9/19
時間: 下午 02:18:09
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
無回應的應用程式 Safari.exe，版本 3.522.15.5。無回應的模組 hungapp 版本 0.0.0.0。無回應的位址 0x00000000。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
資料:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 53 61 66 61 72 69 Safari
0018: 2e 65 78 65 20 33 2e 35 .exe 3.5
0020: 32 32 2e 31 35 2e 35 20 22.15.5
0028: 69 6e 20 68 75 6e 67 61 in hunga
0030: 70 70 20 30 2e 30 2e 30 pp 0.0.0
0038: 2e 30 20 61 74 20 6f 66 .0 at of
0040: 66 73 65 74 20 30 30 30 fset 000
0048: 30 30 30 30 30 00000 事件類型: 錯誤
事件來源: Application Error
事件類別目錄: 無
事件識別碼: 1000
日期: 2007/9/16
時間: 下午 12:33:28
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
失敗的應用程式 iexplore.exe，版本 6.0.2900.2180，失敗的模組 unknown，版本 0.0.0.0，錯誤位址 0x0608fd2d。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
資料:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 69 65 78 ure iex
0018: 70 6c 6f 72 65 2e 65 78 plore.ex
0020: 65 20 36 2e 30 2e 32 39 e 6.0.29
0028: 30 30 2e 32 31 38 30 20 00.2180
0030: 69 6e 20 75 6e 6b 6e 6f in unkno
0038: 77 6e 20 30 2e 30 2e 30 wn 0.0.0
0040: 2e 30 20 61 74 20 6f 66 .0 at of
0048: 66 73 65 74 20 30 36 30 fset 060
0050: 38 66 64 32 64 0d 0a 8fd2d.. 事件類型: 錯誤
事件來源: Application Error
事件類別目錄: 無
事件識別碼: 1000
日期: 2007/9/14
時間: 下午 10:08:44
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
失敗的應用程式 photoshop.exe，版本 9.0.2.0，失敗的模組 photoshop.exe，版本 9.0.2.0，錯誤位址 0x000139fa。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
資料:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 70 68 6f ure pho
0018: 74 6f 73 68 6f 70 2e 65 toshop.e
0020: 78 65 20 39 2e 30 2e 32 xe 9.0.2
0028: 2e 30 20 69 6e 20 70 68 .0 in ph
0030: 6f 74 6f 73 68 6f 70 2e otoshop.
0038: 65 78 65 20 39 2e 30 2e exe 9.0.
0040: 32 2e 30 20 61 74 20 6f 2.0 at o
0048: 66 66 73 65 74 20 30 30 ffset 00
0050: 30 31 33 39 66 61 0d 0a 0139fa..事件類型: 錯誤
事件來源: Application Hang
事件類別目錄: (101)
事件識別碼: 1002
日期: 2007/9/12
時間: 下午 10:19:49
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
無回應的應用程式 notepad.exe，版本 5.1.2600.2180。無回應的模組 hungapp 版本 0.0.0.0。無回應的位址 0x00000000。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
資料:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 6e 6f 74 65 70 61 notepa
0018: 64 2e 65 78 65 20 35 2e d.exe 5.
0020: 31 2e 32 36 30 30 2e 32 1.2600.2
0028: 31 38 30 20 69 6e 20 68 180 in h
0030: 75 6e 67 61 70 70 20 30 ungapp 0
0038: 2e 30 2e 30 2e 30 20 61 .0.0.0 a
0040: 74 20 6f 66 66 73 65 74 t offset
0048: 20 30 30 30 30 30 30 30 0000000
0050: 30 0 事件類型: 錯誤
事件來源: Application Hang
事件類別目錄: (101)
事件識別碼: 1002
日期: 2007/9/3
時間: 下午 11:13:04
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
無回應的應用程式 wmplayer.exe，版本 11.0.5721.5145。無回應的模組 hungapp 版本 0.0.0.0。無回應的位址 0x00000000。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
資料:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 77 6d 70 6c 61 79 wmplay
0018: 65 72 2e 65 78 65 20 31 er.exe 1
0020: 31 2e 30 2e 35 37 32 31 1.0.5721
0028: 2e 35 31 34 35 20 69 6e .5145 in
0030: 20 68 75 6e 67 61 70 70 hungapp
0038: 20 30 2e 30 2e 30 2e 30 0.0.0.0
0040: 20 61 74 20 6f 66 66 73 at offs
0048: 65 74 20 30 30 30 30 30 et 00000
0050: 30 30 30 000 事件類型: 錯誤
事件來源: Application Error
事件類別目錄: (100)
事件識別碼: 1004
日期: 2007/8/26
時間: 下午 07:41:07
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
失敗的應用程式 dllhost.exe，版本 5.1.2600.2180，失敗的模組 unknown，版本 0.0.0.0，錯誤位址 0x00f00de0。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
資料:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 64 6c 6c ure dll
0018: 68 6f 73 74 2e 65 78 65 host.exe
0020: 20 35 2e 31 2e 32 36 30 5.1.260
0028: 30 2e 32 31 38 30 20 69 0.2180 i
0030: 6e 20 75 6e 6b 6e 6f 77 n unknow
0038: 6e 20 30 2e 30 2e 30 2e n 0.0.0.
0040: 30 20 61 74 20 6f 66 66 0 at off
0048: 73 65 74 20 30 30 66 30 set 00f0
0050: 30 64 65 30 0de0
事件類型: 錯誤
事件來源: Application Hang
事件類別目錄: (101)
事件識別碼: 1002
日期: 2007/8/26
時間: 下午 04:09:05
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
無回應的應用程式 Photoshop.exe，版本 9.0.2.0。無回應的模組 hungapp 版本 0.0.0.0。無回應的位址 0x00000000。

請在 http://go.microsoft.com/fwlink/events.asp 查看說明及支援中心，以取得其他資訊。
資料:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 50 68 6f 74 6f 73 Photos
0018: 68 6f 70 2e 65 78 65 20 hop.exe
0020: 39 2e 30 2e 32 2e 30 20 9.0.2.0
0028: 69 6e 20 68 75 6e 67 61 in hunga
0030: 70 70 20 30 2e 30 2e 30 pp 0.0.0
0038: 2e 30 20 61 74 20 6f 66 .0 at of
0040: 66 73 65 74 20 30 30 30 fset 000
0048: 30 30 30 30 30 00000
事件類型: 錯誤
事件來源: Application Error
事件類別目錄: 無
事件識別碼: 1000
日期: 2007/8/21
時間: 下午 12:24:31
使用者: N/A
電腦: YOUR-EE2B139BD5
描述:
失敗的應用程式 safari.exe，版本 3.522.15.5，失敗的模組 coregraphics.dll，版本 1.0.22.0，錯誤位址 0x00028b88。

請在