0x7c911e58 error

JL · Apr 27, 2008

I installed AVG 8 in my WinXP, and from that moment, it is a mess in my
computer. I solved many issues (in particulat my Live Messenger refused to
sign in) uninstalling the program, but it seems it doesn't really want to
uninstall every piece, even with Ccleaner, Spybot etc... I am not good enough
to go deeply in the computer.

I constantly get this error in IE "0x7911e58 .... memory cannot be read. It
is a dll error. Sorry I don't have the complete message and am afraid to do
something to reproduce it, I can lose the rest

Could you please tell me what that means and what I can do?

Thank you very much

nass · Apr 27, 2008

JL said:
I installed AVG 8 in my WinXP, and from that moment, it is a mess in my
computer. I solved many issues (in particulat my Live Messenger refused to
sign in) uninstalling the program, but it seems it doesn't really want to
uninstall every piece, even with Ccleaner, Spybot etc... I am not good enough
to go deeply in the computer.

I constantly get this error in IE "0x7911e58 .... memory cannot be read. It
is a dll error. Sorry I don't have the complete message and am afraid to do
something to reproduce it, I can lose the rest

Could you please tell me what that means and what I can do?

Thank you very much

Go through these cleaning steps:
1... Click start >> Control Panel >> Double Click Network and Internet
Connections >> Double click Internet Options, on the IE Properties window
you will see these Options:
General | Security | Privacy | Content | Connections | Programs
| Advanced .

Click on General Tab (1st Tab on the left) and you will see a Button called
[ Clear History ..] click on it to clear your History caches, then click on
[Delete Files..] to delete Internet Files created over the time, click on [
Delete Cookies...] to delete your cookies left by visiting websites.
Then click on Advanced tab and scroll down to under the Browsing Option:
[&] Browsing
[ ] Enable Third-Party browser extensions (Req Rest) uncheck this box.

= Then try to Disable the Add-Ons on your Browser somehow installed on your
browser, On how to disable the Add-ons follow this:
Click on Programs Tab and then click the Manage Add-Ons Button there Disable
the None/Not Verified Plug-ins/Add-ons ( you need to Renable them one-by-one
later and see which is the culprit .
How to manage Add-Ons:
http://support.microsoft.com/kb/883256

Scan for malware from here:
SuperAntispyware - Free
http://www.superantispyware.com/superantispywarefreevspro.html
http://onecare.live.com/site/en-gb/default.htm?s_cid=sah
http://onecare.live.com/standard/en-gb/default.htm

How to speed your PC:
http://www.blackviper.com/WinXP/supertweaks.htm

Run disk clean up and then run this command:
sfc /scannow

Have a look in the Event Viewer and send us the error messages you will see
there in your next post:
Open a Notepad, customize or minimize to the taskbar as you will need it
later for this step to copy the error message on it.
Open a run command and type in:
eventvwr.msc click [OK] you will get the Event viewer control Panel.
click on each of these:
Application
System
Security
Look in the right Pane/window for error message with red (X) or Yellow
exclamation mark /!\ , double click each one to get more info about the
causer.
On the Event error properties message you will see:
Up Arrow
Down arrow
Two pages
Click on the two pages to copy the error message then bring up the Notepad
you opened earlier and right click on the first line and select Paste from
the list, this will paste the error message on a Notepad.
Please don't duplicate the error message one of each kind will be sufficient.
HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.microsoft.com/kb/308427/en-us

Please we need just the error messages with Red (X) and don't repeat the
error, just one of each kind and post them back in your next post.

HTH.
nass

JL · Apr 28, 2008

Hello Nass,

Thanks a lot for your reply... I spent almost all day on it. There are so
many errors!

I did what you said (delete cookies) only because I usually don't use IE, I
use more Firefox, and I have about 1000 different IDs and passwords, so I
want to be able to login automatically. Same for History, I need it. I did it
also. I clean up my computers regularly, but only what I don't need. I also
deleted the bad add-ons.

sfc /scannov opens a DOS windows that closes immediately. So I couldn't copy
anything.

I didn't scan for malware yet, I will do it later, I wanted to answer you
before.

But here is the million errors in the eventvwr.msc

APPLICATIONS
Windows saved user SUNFORCE\J... registry while an application or service
was still using the registry during log off. The memory used by the user's
registry has not been freed. The registry will be unloaded when it is no
longer in use.

This is often caused by services running as a user account, try configuring
the services to run in either the LocalService or NetworkService account.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
_____________________________________________________________________

Faulting application outlook.exe, version 10.0.6838.0, faulting module
vbe6.dll, version 6.5.10.24, fault address 0x0000555b.
__________________________________________________________________

Faulting application outlook.exe, version 10.0.6838.0, faulting module
unknown, version 0.0.0.0, fault address 0x00000000.

____________________________________________________________________

A provider, OffProv10, has been registered in the WMI namespace,
Root\MSAPPS10, but did not specify the HostingModel property. This provider
will be run using the LocalSystem account. This account is privileged and
the provider may cause a security violation if it does not correctly
impersonate user requests. Ensure that provider has been reviewed for
security behavior and update the HostingModel property of the provider
registration to an account with the least privileges possible for the
required functionality.

_____________________________________________________________________

SYSTEM
The following boot-start or system-start driver(s) failed to load:
AvgLdx86
_____________________________________________________________________

The General Purpose USB Driver (adildr.sys) service failed to start due to
the following error:
The system cannot find the file specified.
_____________________________________________________________________

Your computer was not assigned an address from the network (by the DHCP
Server) for the Network Card with network address 000E3541722C. The
following error occurred:
The operation was canceled by the user. . Your computer will continue to try
and obtain an address on its own from the network address (DHCP) server.
___________________________________________________________________

Your computer was not assigned an address from the network (by the DHCP
Server) for the Network Card with network address 000E3541722C. The
following error occurred:
The semaphore timeout period has expired. . Your computer will continue to
try and obtain an address on its own from the network address (DHCP) server.

_____________________________________________________________________

Your computer has lost the lease to its IP address 192.168.2.3 on the
Network Card with network address 000E3541722C.

_____________________________________________________________________

The time provider NtpClient is configured to acquire time from one or more
time sources, however none of the sources are currently accessible. No
attempt to contact a source will be made for 14 minutes. NtpClient has no
source of accurate time.

____________________________________________________________________

Listen failed: 23: The ncb_lana_num member did not specify a valid network
number.
_____________________________________________________________________

Listen failed: 15:
___________________________________________________________________

Listen failed: EB: Hardware error on NetBIOS card
____________________________________________________________________

Unknown Error Code returned by Lana number 1 while adding node name to
network: 0x23
_____________________________________________________________________

Listen failed: 01: An illegal buffer length was supplied.
_________________________________________________________________

The IP address lease 192.168.1.100 for the Network Card with network address
000E3541722C has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent
a DHCPNACK message).
____________________________________________________________________

Initialization of "NDDENB32" DLL failed
____________________________________________________________________

Resolve Partial Assembly failed for Microsoft.VC80.MFCLOC. Reference error
message: The referenced assembly is not installed on your system.
__________________________________________________________________

Generate Activation Context failed for C:\Program Files\Kiwee
Toolbar2\1.3.118\MFC80U.DLL. Reference error message: The operation completed
successfully.
________________________________________________________________

Dependent Assembly Microsoft.VC80.MFCLOC could not be found and Last Error
was The referenced assembly is not installed on your system.
________________________________________________________________

Unknown Error Code returned by Lana number 0 while adding node name to
network: 0x23
____________________________________________________________________

Listen failed: 09: No resource was available.
___________________________________________________

SECURITY
No error, I only get that
The audit log was cleared
Primary User Name: SYSTEM
Primary Domain: NT AUTHORITY
Primary Logon ID: (0x0,0x3E7)
Client User Name: SYSTEM
Client Domain: NT AUTHORITY
Client Logon ID: (0x0,0x3E7)

Thank you for your help, I hope we can solve those issues

nass said:
JL said:

I installed AVG 8 in my WinXP, and from that moment, it is a mess in my
computer. I solved many issues (in particulat my Live Messenger refused to
sign in) uninstalling the program, but it seems it doesn't really want to
uninstall every piece, even with Ccleaner, Spybot etc... I am not good enough
to go deeply in the computer.

I constantly get this error in IE "0x7911e58 .... memory cannot be read. It
is a dll error. Sorry I don't have the complete message and am afraid to do
something to reproduce it, I can lose the rest

Could you please tell me what that means and what I can do?

Thank you very much

Click to expand...

Go through these cleaning steps:
1... Click start >> Control Panel >> Double Click Network and Internet
Connections >> Double click Internet Options, on the IE Properties window
you will see these Options:
General | Security | Privacy | Content | Connections | Programs
| Advanced .

Click on General Tab (1st Tab on the left) and you will see a Button called
[ Clear History ..] click on it to clear your History caches, then click on
[Delete Files..] to delete Internet Files created over the time, click on [
Delete Cookies...] to delete your cookies left by visiting websites.
Then click on Advanced tab and scroll down to under the Browsing Option:
[&] Browsing
[ ] Enable Third-Party browser extensions (Req Rest) uncheck this box.

= Then try to Disable the Add-Ons on your Browser somehow installed on your
browser, On how to disable the Add-ons follow this:
Click on Programs Tab and then click the Manage Add-Ons Button there Disable
the None/Not Verified Plug-ins/Add-ons ( you need to Renable them one-by-one
later and see which is the culprit .
How to manage Add-Ons:
http://support.microsoft.com/kb/883256

Scan for malware from here:
SuperAntispyware - Free
http://www.superantispyware.com/superantispywarefreevspro.html
http://onecare.live.com/site/en-gb/default.htm?s_cid=sah
http://onecare.live.com/standard/en-gb/default.htm

How to speed your PC:
http://www.blackviper.com/WinXP/supertweaks.htm

Run disk clean up and then run this command:
sfc /scannow

Have a look in the Event Viewer and send us the error messages you will see
there in your next post:
Open a Notepad, customize or minimize to the taskbar as you will need it
later for this step to copy the error message on it.
Open a run command and type in:
eventvwr.msc click [OK] you will get the Event viewer control Panel.
click on each of these:
Application
System
Security
Look in the right Pane/window for error message with red (X) or Yellow
exclamation mark /!\ , double click each one to get more info about the
causer.
On the Event error properties message you will see:
Up Arrow
Down arrow
Two pages
Click on the two pages to copy the error message then bring up the Notepad
you opened earlier and right click on the first line and select Paste from
the list, this will paste the error message on a Notepad.
Please don't duplicate the error message one of each kind will be sufficient.
HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.microsoft.com/kb/308427/en-us

Please we need just the error messages with Red (X) and don't repeat the
error, just one of each kind and post them back in your next post.

HTH.
nass

Colin Barnhorst · Apr 28, 2008

Type "cmd" in the Start/Search box and hit Enter. Then type "sfc /scannow"
in the command windows. It will stay open. You close it with Exit + Enter.

JL said:
Hello Nass,

Thanks a lot for your reply... I spent almost all day on it. There are so
many errors!

I did what you said (delete cookies) only because I usually don't use IE,
I
use more Firefox, and I have about 1000 different IDs and passwords, so I
want to be able to login automatically. Same for History, I need it. I did
it
also. I clean up my computers regularly, but only what I don't need. I
also
deleted the bad add-ons.

sfc /scannov opens a DOS windows that closes immediately. So I couldn't
copy
anything.

I didn't scan for malware yet, I will do it later, I wanted to answer you
before.

But here is the million errors in the eventvwr.msc

APPLICATIONS
Windows saved user SUNFORCE\J... registry while an application or service
was still using the registry during log off. The memory used by the user's
registry has not been freed. The registry will be unloaded when it is no
longer in use.

This is often caused by services running as a user account, try
configuring
the services to run in either the LocalService or NetworkService account.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
_____________________________________________________________________

Faulting application outlook.exe, version 10.0.6838.0, faulting module
vbe6.dll, version 6.5.10.24, fault address 0x0000555b.
__________________________________________________________________

Faulting application outlook.exe, version 10.0.6838.0, faulting module
unknown, version 0.0.0.0, fault address 0x00000000.

____________________________________________________________________

A provider, OffProv10, has been registered in the WMI namespace,
Root\MSAPPS10, but did not specify the HostingModel property. This
provider
will be run using the LocalSystem account. This account is privileged and
the provider may cause a security violation if it does not correctly
impersonate user requests. Ensure that provider has been reviewed for
security behavior and update the HostingModel property of the provider
registration to an account with the least privileges possible for the
required functionality.

_____________________________________________________________________

SYSTEM
The following boot-start or system-start driver(s) failed to load:
AvgLdx86
_____________________________________________________________________

The General Purpose USB Driver (adildr.sys) service failed to start due to
the following error:
The system cannot find the file specified.
_____________________________________________________________________

Your computer was not assigned an address from the network (by the DHCP
Server) for the Network Card with network address 000E3541722C. The
following error occurred:
The operation was canceled by the user. . Your computer will continue to
try
and obtain an address on its own from the network address (DHCP) server.
___________________________________________________________________

Your computer was not assigned an address from the network (by the DHCP
Server) for the Network Card with network address 000E3541722C. The
following error occurred:
The semaphore timeout period has expired. . Your computer will continue to
try and obtain an address on its own from the network address (DHCP)
server.

_____________________________________________________________________

Your computer has lost the lease to its IP address 192.168.2.3 on the
Network Card with network address 000E3541722C.

_____________________________________________________________________

The time provider NtpClient is configured to acquire time from one or more
time sources, however none of the sources are currently accessible. No
attempt to contact a source will be made for 14 minutes. NtpClient has no
source of accurate time.

____________________________________________________________________

Listen failed: 23: The ncb_lana_num member did not specify a valid network
number.
_____________________________________________________________________

Listen failed: 15:
___________________________________________________________________

Listen failed: EB: Hardware error on NetBIOS card
____________________________________________________________________

Unknown Error Code returned by Lana number 1 while adding node name to
network: 0x23
_____________________________________________________________________

Listen failed: 01: An illegal buffer length was supplied.
_________________________________________________________________

The IP address lease 192.168.1.100 for the Network Card with network
address
000E3541722C has been denied by the DHCP server 0.0.0.0 (The DHCP Server
sent
a DHCPNACK message).
____________________________________________________________________

Initialization of "NDDENB32" DLL failed
____________________________________________________________________

Resolve Partial Assembly failed for Microsoft.VC80.MFCLOC. Reference error
message: The referenced assembly is not installed on your system.
__________________________________________________________________

Generate Activation Context failed for C:\Program Files\Kiwee
Toolbar2\1.3.118\MFC80U.DLL. Reference error message: The operation
completed
successfully.
________________________________________________________________

Dependent Assembly Microsoft.VC80.MFCLOC could not be found and Last Error
was The referenced assembly is not installed on your system.
________________________________________________________________

Unknown Error Code returned by Lana number 0 while adding node name to
network: 0x23
____________________________________________________________________

Listen failed: 09: No resource was available.
___________________________________________________

SECURITY
No error, I only get that
The audit log was cleared
Primary User Name: SYSTEM
Primary Domain: NT AUTHORITY
Primary Logon ID: (0x0,0x3E7)
Client User Name: SYSTEM
Client Domain: NT AUTHORITY
Client Logon ID: (0x0,0x3E7)

Thank you for your help, I hope we can solve those issues

nass said:

JL said:

I installed AVG 8 in my WinXP, and from that moment, it is a mess in my
computer. I solved many issues (in particulat my Live Messenger refused
to
sign in) uninstalling the program, but it seems it doesn't really want
to
uninstall every piece, even with Ccleaner, Spybot etc... I am not good
enough
to go deeply in the computer.

I constantly get this error in IE "0x7911e58 .... memory cannot be
read. It
is a dll error. Sorry I don't have the complete message and am afraid
to do
something to reproduce it, I can lose the rest

Could you please tell me what that means and what I can do?

Thank you very much

Click to expand...

Go through these cleaning steps:
1... Click start >> Control Panel >> Double Click Network and Internet
Connections >> Double click Internet Options, on the IE Properties window
you will see these Options:
General | Security | Privacy | Content | Connections | Programs
| Advanced .

Click on General Tab (1st Tab on the left) and you will see a Button
called
[ Clear History ..] click on it to clear your History caches, then click
on
[Delete Files..] to delete Internet Files created over the time, click on
[
Delete Cookies...] to delete your cookies left by visiting websites.
Then click on Advanced tab and scroll down to under the Browsing Option:
[&] Browsing
[ ] Enable Third-Party browser extensions (Req Rest) uncheck this box.

= Then try to Disable the Add-Ons on your Browser somehow installed on
your
browser, On how to disable the Add-ons follow this:
Click on Programs Tab and then click the Manage Add-Ons Button there
Disable
the None/Not Verified Plug-ins/Add-ons ( you need to Renable them
one-by-one
later and see which is the culprit .
How to manage Add-Ons:
http://support.microsoft.com/kb/883256

Scan for malware from here:
SuperAntispyware - Free
http://www.superantispyware.com/superantispywarefreevspro.html
http://onecare.live.com/site/en-gb/default.htm?s_cid=sah
http://onecare.live.com/standard/en-gb/default.htm

How to speed your PC:
http://www.blackviper.com/WinXP/supertweaks.htm

Run disk clean up and then run this command:
sfc /scannow

Have a look in the Event Viewer and send us the error messages you will
see
there in your next post:
Open a Notepad, customize or minimize to the taskbar as you will need it
later for this step to copy the error message on it.
Open a run command and type in:
eventvwr.msc click [OK] you will get the Event viewer control Panel.
click on each of these:
Application
System
Security
Look in the right Pane/window for error message with red (X) or Yellow
exclamation mark /!\ , double click each one to get more info about the
causer.
On the Event error properties message you will see:
Up Arrow
Down arrow
Two pages
Click on the two pages to copy the error message then bring up the
Notepad
you opened earlier and right click on the first line and select Paste
from
the list, this will paste the error message on a Notepad.
Please don't duplicate the error message one of each kind will be
sufficient.
HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.microsoft.com/kb/308427/en-us

Please we need just the error messages with Red (X) and don't repeat the
error, just one of each kind and post them back in your next post.

HTH.
nass

Click to expand...

nass · Apr 28, 2008

:

Hi,
APPLICATIONS
Windows saved user SUNFORCE\J... registry while an application or service
was still using the registry during log off. The memory used by the user's
registry has not been freed. The registry will be unloaded when it is no
longer in use.

This is often caused by services running as a user account, try configuring
the services to run in either the LocalService or NetworkService account.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
_____________________________________________________________________

Faulting application outlook.exe, version 10.0.6838.0, faulting module
vbe6.dll, version 6.5.10.24, fault address 0x0000555b.

Run the updates engine for XP Office:
http://office.microsoft.com/Downloads/default.aspx
Description of InterConnect 2007 Service Pack 1
http://support.microsoft.com/kb/937585
Microsoft Security Bulletin MS08-013 â€“ Critical
http://www.microsoft.com/technet/security/Bulletin/MS08-013.mspx
How to use the Inbox Repair Tool to recover messages in Outlook 2000 that is
installed with Corporate and Workgroup option
http://support.microsoft.com/kb/197316
http://support.microsoft.com/kb/287497
Microsoft Office Outlook 2003 Solution Center
http://support.microsoft.com/ph/2520/en-us/?sid=312&aid=1&GSA_AC_More1
How to understand the repair feature in Office 2003 and in Office XP
http://support.microsoft.com/kb/822238

__________________________________________________________________

Faulting application outlook.exe, version 10.0.6838.0, faulting module
unknown, version 0.0.0.0, fault address 0x00000000.

____________________________________________________________________

A provider, OffProv10, has been registered in the WMI namespace,
Root\MSAPPS10, but did not specify the HostingModel property. This provider
will be run using the LocalSystem account. This account is privileged and
the provider may cause a security violation if it does not correctly
impersonate user requests. Ensure that provider has been reviewed for
security behavior and update the HostingModel property of the provider
registration to an account with the least privileges possible for the
required functionality.

What you are seeing in this error is an alert message from the
WMI system to let you know that some, potentially non-MS.
Again the XP office need to be uninstall/repair.
Are you running on a Domain or on local machine?

_____________________________________________________________________

SYSTEM
The following boot-start or system-start driver(s) failed to load:
AvgLdx86

AVG Anti-virus!

_____________________________________________________________________

The General Purpose USB Driver (adildr.sys) service failed to start due to
the following error:
The system cannot find the file specified.

ADI ADSL chipset loader

c:\windows\system32\drivers\adildr.sys
Remove also from the registry by openning a run command and type in:
regedit click [OK] and locate these Keys:
[-]HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run = remove
from the right pane/window
[-]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ADILOADER remove the
service.
[-]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ADILOADER\Security
[-]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ADILOADER\Enum
what your modem/ADSL or did you have a modem software installed before?

_____________________________________________________________________

Your computer was not assigned an address from the network (by the DHCP
Server) for the Network Card with network address 000E3541722C. The
following error occurred:
The operation was canceled by the user. . Your computer will continue to try
and obtain an address on its own from the network address (DHCP) server.

Make sure the DHCP is started/Enabled on your Modem UI page or on the
services control panel and laso on your NIC/TCP/IP properties.
Try this Run command:
services.msc click [OK] and locate the DHCP Client and make sure it started
Automatically.
Alos this command:
ipconfig /flushdns
ipconfig /renew
netsh winsock reset
Reboot your machine, does the error reprduce itself?
___________________________________________________________________

Your computer has lost the lease to its IP address 192.168.2.3 on the
Network Card with network address 000E3541722C.

Please update the firmware for your NIC/Router/Modem from the vendor website.
_____________________________________________________________________

The time provider NtpClient is configured to acquire time from one or more
time sources, however none of the sources are currently accessible. No
attempt to contact a source will be made for 14 minutes. NtpClient has no
source of accurate time.

You have an issue with the NTP time server.

W32Time frequently logs Event
http://support.microsoft.com/kb/830092

Time synchronization may not succeed when you try to synchronize with a
non-Windows NTP server in Windows Server 2003

http://support.microsoft.com/kb/875424
____________________________________________________________________

Listen failed: 23: The ncb_lana_num member did not specify a valid network
number.

stop the Network DDE service or set the start to manual.
_____________________________________________________________________

Listen failed: 15:
___________________________________________________________________

Listen failed: EB: Hardware error on NetBIOS card
____________________________________________________________________

Unknown Error Code returned by Lana number 1 while adding node name to
network: 0x23
_____________________________________________________________________

Listen failed: 01: An illegal buffer length was supplied.
_________________________________________________________________

The IP address lease 192.168.1.100 for the Network Card with network address
000E3541722C has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent
a DHCPNACK message).
____________________________________________________________________

Initialization of "NDDENB32" DLL failed

Vulnerability in NetDDE Could Allow Remote Code Execution (841533)
http://www.microsoft.com/technet/security/bulletin/MS04-031.mspx
http://support.microsoft.com/?kbid=894083
____________________________________________________________________

Resolve Partial Assembly failed for Microsoft.VC80.MFCLOC. Reference error
message: The referenced assembly is not installed on your system.
__________________________________________________________________

Generate Activation Context failed for C:\Program Files\Kiwee
Toolbar2\1.3.118\MFC80U.DLL. Reference error message: The operation completed
successfully.
________________________________________________________________

Dependent Assembly Microsoft.VC80.MFCLOC could not be found and Last Error
was The referenced assembly is not installed on your system.
________________________________________________________________

Unknown Error Code returned by Lana number 0 while adding node name to
network: 0x23
____________________________________________________________________

Listen failed: 09: No resource was available.
___________________________________________________

SECURITY
No error, I only get that
The audit log was cleared
Primary User Name: SYSTEM
Primary Domain: NT AUTHORITY
Primary Logon ID: (0x0,0x3E7)
Client User Name: SYSTEM
Client Domain: NT AUTHORITY
Client Logon ID: (0x0,0x3E7)

SuperAntispyware - Free
http://www.superantispyware.com/superantispywarefreevspro.html
RootkitRevealer v1.71
By Bryce Cogswell and Mark Russinovich
http://www.microsoft.com/technet/sysinternals/Security/RootkitRevealer.mspx

Run a scan from here on-line:
http://security.symantec.com/sscv6/default.asp?langid=ie&venid=sym
http://www3.ca.com/securityadvisor/virusinfo/scan.aspx
Download Avast Cleaner (off-line scanner) from here:
http://www.avast.com/eng/avast-virus-cleaner.html

Lots of tools to download and disinfect your machine (off-line scanner):
http://www.bitdefender.co.uk/site/Downloads/browseFreeRemovalTool/

You may have a bad RAM try to test your RAM by running Memory test by
downloading this tool and unzip it and make a floppy or CD/DVD and run it on
Reboot.
http://oca.microsoft.com/en/windiag.asp.

Download the Hijackthis and send the report to one of
many
forums for analysis and troubleshooting:
When all else fails, HijackThis v2.0.2
(http://www.trendsecure.com/portal/en-US/threat_analytics/hijackthis.php) is
the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware. Post
your log to:
http://www.spywareinfo.com/~merijn/downloads.html
http://aumha.net/viewforum.php?f=30,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7
http://www.bleepingcomputer.com/tutorials/tutorial42.html
http://www.bleepingcomputer.com/forums/
Or other appropriate
forums for expert analysis, not here.
can you please send me a copy of the log at: (e-mail address removed)
Good luck,
nass

JL · Apr 28, 2008

Hello,

Thanks again.... I need at least a month or two to check everything. I
printed your message, so I can refer to it when I want.

I did some other things, one of them is Hijack, that I have installed.

They suggest, BEFORE deleting everything, to send the report to a competent
person. so there it is.

I found the exact error "the instruction at 0x7c911e58 referenced memory at
0x3030322e. The memory couldn't be read. click ok to terminate the program".

This AVG8 is a real pain in the..... you know.

More help?
Thanks
It is very difficult to find a message that I previously posted. You explain
how, but I can't find the way

nass said:
:

Hi,
APPLICATIONS
Windows saved user SUNFORCE\J... registry while an application or service
was still using the registry during log off. The memory used by the user's
registry has not been freed. The registry will be unloaded when it is no
longer in use.

This is often caused by services running as a user account, try configuring
the services to run in either the LocalService or NetworkService account.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
_____________________________________________________________________

Faulting application outlook.exe, version 10.0.6838.0, faulting module
vbe6.dll, version 6.5.10.24, fault address 0x0000555b.

Run the updates engine for XP Office:
http://office.microsoft.com/Downloads/default.aspx
Description of InterConnect 2007 Service Pack 1
http://support.microsoft.com/kb/937585
Microsoft Security Bulletin MS08-013 â€“ Critical
http://www.microsoft.com/technet/security/Bulletin/MS08-013.mspx
How to use the Inbox Repair Tool to recover messages in Outlook 2000 that is
installed with Corporate and Workgroup option
http://support.microsoft.com/kb/197316
http://support.microsoft.com/kb/287497
Microsoft Office Outlook 2003 Solution Center
http://support.microsoft.com/ph/2520/en-us/?sid=312&aid=1&GSA_AC_More1
How to understand the repair feature in Office 2003 and in Office XP
http://support.microsoft.com/kb/822238

__________________________________________________________________

Faulting application outlook.exe, version 10.0.6838.0, faulting module
unknown, version 0.0.0.0, fault address 0x00000000.

____________________________________________________________________

A provider, OffProv10, has been registered in the WMI namespace,
Root\MSAPPS10, but did not specify the HostingModel property. This provider
will be run using the LocalSystem account. This account is privileged and
the provider may cause a security violation if it does not correctly
impersonate user requests. Ensure that provider has been reviewed for
security behavior and update the HostingModel property of the provider
registration to an account with the least privileges possible for the
required functionality.

What you are seeing in this error is an alert message from the
WMI system to let you know that some, potentially non-MS.
Again the XP office need to be uninstall/repair.
Are you running on a Domain or on local machine?

_____________________________________________________________________

SYSTEM
The following boot-start or system-start driver(s) failed to load:
AvgLdx86

AVG Anti-virus!

_____________________________________________________________________

The General Purpose USB Driver (adildr.sys) service failed to start due to
the following error:
The system cannot find the file specified.

ADI ADSL chipset loader

c:\windows\system32\drivers\adildr.sys
Remove also from the registry by openning a run command and type in:
regedit click [OK] and locate these Keys:
[-]HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run = remove
from the right pane/window
[-]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ADILOADER remove the
service.
[-]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ADILOADER\Security
[-]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ADILOADER\Enum
what your modem/ADSL or did you have a modem software installed before?

_____________________________________________________________________

Your computer was not assigned an address from the network (by the DHCP
Server) for the Network Card with network address 000E3541722C. The
following error occurred:
The operation was canceled by the user. . Your computer will continue to try
and obtain an address on its own from the network address (DHCP) server.

Make sure the DHCP is started/Enabled on your Modem UI page or on the
services control panel and laso on your NIC/TCP/IP properties.
Try this Run command:
services.msc click [OK] and locate the DHCP Client and make sure it started
Automatically.
Alos this command:
ipconfig /flushdns
ipconfig /renew
netsh winsock reset
Reboot your machine, does the error reprduce itself?
___________________________________________________________________

Your computer has lost the lease to its IP address 192.168.2.3 on the
Network Card with network address 000E3541722C.

Please update the firmware for your NIC/Router/Modem from the vendor website.
_____________________________________________________________________

The time provider NtpClient is configured to acquire time from one or more
time sources, however none of the sources are currently accessible. No
attempt to contact a source will be made for 14 minutes. NtpClient has no
source of accurate time.

You have an issue with the NTP time server.

W32Time frequently logs Event
http://support.microsoft.com/kb/830092

Time synchronization may not succeed when you try to synchronize with a
non-Windows NTP server in Windows Server 2003

http://support.microsoft.com/kb/875424
____________________________________________________________________

Listen failed: 23: The ncb_lana_num member did not specify a valid network
number.

stop the Network DDE service or set the start to manual.
_____________________________________________________________________

Listen failed: 15:
___________________________________________________________________

Listen failed: EB: Hardware error on NetBIOS card
____________________________________________________________________

Unknown Error Code returned by Lana number 1 while adding node name to
network: 0x23
_____________________________________________________________________

Listen failed: 01: An illegal buffer length was supplied.
_________________________________________________________________

The IP address lease 192.168.1.100 for the Network Card with network address
000E3541722C has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent
a DHCPNACK message).
____________________________________________________________________

Initialization of "NDDENB32" DLL failed

Vulnerability in NetDDE Could Allow Remote Code Execution (841533)
http://www.microsoft.com/technet/security/bulletin/MS04-031.mspx
http://support.microsoft.com/?kbid=894083
____________________________________________________________________

Resolve Partial Assembly failed for Microsoft.VC80.MFCLOC. Reference error
message: The referenced assembly is not installed on your system.
__________________________________________________________________

Generate Activation Context failed for C:\Program Files\Kiwee
Toolbar2\1.3.118\MFC80U.DLL. Reference error message: The operation completed
successfully.
________________________________________________________________

Dependent Assembly Microsoft.VC80.MFCLOC could not be found and Last Error
was The referenced assembly is not installed on your system.
________________________________________________________________

Unknown Error Code returned by Lana number 0 while adding node name to
network: 0x23
____________________________________________________________________

Listen failed: 09: No resource was available.
___________________________________________________

SECURITY
No error, I only get that
The audit log was cleared
Primary User Name: SYSTEM
Primary Domain: NT AUTHORITY
Primary Logon ID: (0x0,0x3E7)
Client User Name: SYSTEM
Client Domain: NT AUTHORITY
Client Logon ID: (0x0,0x3E7)

SuperAntispyware - Free
http://www.superantispyware.com/superantispywarefreevspro.html
RootkitRevealer v1.71
By Bryce Cogswell and Mark Russinovich
http://www.microsoft.com/technet/sysinternals/Security/RootkitRevealer.mspx

Run a scan from here on-line:
http://security.symantec.com/sscv6/default.asp?langid=ie&venid=sym
http://www3.ca.com/securityadvisor/virusinfo/scan.aspx
Download Avast Cleaner (off-line scanner) from here:
http://www.avast.com/eng/avast-virus-cleaner.html

Lots of tools to download and disinfect your machine (off-line scanner):
http://www.bitdefender.co.uk/site/Downloads/browseFreeRemovalTool/

You may have a bad RAM try to test your RAM by running Memory test by
downloading this tool and unzip it and make a floppy or CD/DVD and run it on
Reboot.
http://oca.microsoft.com/en/windiag.asp.

Download the Hijackthis and send the report to one of
many
forums for analysis and troubleshooting:
When all else fails, HijackThis v2.0.2
(http://www.trendsecure.com/portal/en-US/threat_analytics/hijackthis.php) is
the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware. Post
your log to:
http://www.spywareinfo.com/~merijn/downloads.html
http://aumha.net/viewforum.php?f=30,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7
http://www.bleepingcomputer.com/tutorials/tutorial42.html
http://www.bleepingcomputer.com/forums/
Or other appropriate
forums for expert analysis, not here.
can you please send me a copy of the log at: (e-mail address removed)
Good luck,
nass

0x7c911e58 error

JL

nass

JL

Colin Barnhorst

nass

JL