explorer problem

[johngalt]

2008-05-27 16:46:15, Info                  CSI    000000e8 [SR] Cannot repair member file [l:20{10}]"tcpmon.ini" of Microsoft-Windows-Printing-StandardPortMonitor-TCPMonINI, Version = 6.0.6000.16386, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2008-05-27 16:46:21, Info                  CSI    000000e9 Hashes for file member \SystemRoot\WinSxS\x86_microsoft-windows-p..rtmonitor-tcpmonini_31bf3856ad364e35_6.0.6000.16386_none_d04210aeaa5e863a\tcpmon.ini do not match actual file [l:20{10}]"tcpmon.ini" :
  Found: {l:32 b:0cSv9zUxBdxIACUdN3TVidA8dd5qeWe9Ct2GEzhrLi4=} Expected: {l:32 b:Uu3AaPzr3p1NNnR6zY6aW6nbeOxBy6AP9XHSLyFUjD8=}
2008-05-27 16:46:21, Info                  CSI    000000ea [SR] Cannot repair member file [l:20{10}]"tcpmon.ini" of Microsoft-Windows-Printing-StandardPortMonitor-TCPMonINI, Version = 6.0.6000.16386, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2008-05-27 16:46:21, Info                  CSI    000000eb Hashes for file member \??\C:\Windows\System32\tcpmon.ini do not match actual file [l:20{10}]"tcpmon.ini" :
  Found: {l:32 b:0cSv9zUxBdxIACUdN3TVidA8dd5qeWe9Ct2GEzhrLi4=} Expected: {l:32 b:Uu3AaPzr3p1NNnR6zY6aW6nbeOxBy6AP9XHSLyFUjD8=}
2008-05-27 16:46:21, Info                  CSI    000000ec Hashes for file member \SystemRoot\WinSxS\x86_microsoft-windows-p..rtmonitor-tcpmonini_31bf3856ad364e35_6.0.6000.16386_none_d04210aeaa5e863a\tcpmon.ini do not match actual file [l:20{10}]"tcpmon.ini" :
  Found: {l:32 b:0cSv9zUxBdxIACUdN3TVidA8dd5qeWe9Ct2GEzhrLi4=} Expected: {l:32 b:Uu3AaPzr3p1NNnR6zY6aW6nbeOxBy6AP9XHSLyFUjD8=}
2008-05-27 16:46:21, Info                  CSI    000000ed [SR] Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:20{10}]"tcpmon.ini"; source file in store is also corrupted
2008-05-27 16:46:21, Info                  CSI    000000ee Repair results created:


2008-05-27 16:50:11, Info                  CSI    00000151 [SR] Verify complete
2008-05-27 16:50:11, Info                  CSI    00000152 [SR] Repairing 1 components
2008-05-27 16:50:11, Info                  CSI    00000153 [SR] Beginning Verify and Repair transaction
2008-05-27 16:50:11, Info                  CSI    00000154 Hashes for file member \SystemRoot\WinSxS\x86_microsoft-windows-p..rtmonitor-tcpmonini_31bf3856ad364e35_6.0.6000.16386_none_d04210aeaa5e863a\tcpmon.ini do not match actual file [l:20{10}]"tcpmon.ini" :
  Found: {l:32 b:0cSv9zUxBdxIACUdN3TVidA8dd5qeWe9Ct2GEzhrLi4=} Expected: {l:32 b:Uu3AaPzr3p1NNnR6zY6aW6nbeOxBy6AP9XHSLyFUjD8=}
2008-05-27 16:50:11, Info                  CSI    00000155 [SR] Cannot repair member file [l:20{10}]"tcpmon.ini" of Microsoft-Windows-Printing-StandardPortMonitor-TCPMonINI, Version = 6.0.6000.16386, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2008-05-27 16:50:11, Info                  CSI    00000156 Hashes for file member \SystemRoot\WinSxS\x86_microsoft-windows-p..rtmonitor-tcpmonini_31bf3856ad364e35_6.0.6000.16386_none_d04210aeaa5e863a\tcpmon.ini do not match actual file [l:20{10}]"tcpmon.ini" :
  Found: {l:32 b:0cSv9zUxBdxIACUdN3TVidA8dd5qeWe9Ct2GEzhrLi4=} Expected: {l:32 b:Uu3AaPzr3p1NNnR6zY6aW6nbeOxBy6AP9XHSLyFUjD8=}
2008-05-27 16:50:11, Info                  CSI    00000157 [SR] Cannot repair member file [l:20{10}]"tcpmon.ini" of Microsoft-Windows-Printing-StandardPortMonitor-TCPMonINI, Version = 6.0.6000.16386, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2008-05-27 16:50:11, Info                  CSI    00000158 Hashes for file member \??\C:\Windows\System32\tcpmon.ini do not match actual file [l:20{10}]"tcpmon.ini" :
  Found: {l:32 b:0cSv9zUxBdxIACUdN3TVidA8dd5qeWe9Ct2GEzhrLi4=} Expected: {l:32 b:Uu3AaPzr3p1NNnR6zY6aW6nbeOxBy6AP9XHSLyFUjD8=}
2008-05-27 16:50:11, Info                  CSI    00000159 Hashes for file member \SystemRoot\WinSxS\x86_microsoft-windows-p..rtmonitor-tcpmonini_31bf3856ad364e35_6.0.6000.16386_none_d04210aeaa5e863a\tcpmon.ini do not match actual file [l:20{10}]"tcpmon.ini" :
  Found: {l:32 b:0cSv9zUxBdxIACUdN3TVidA8dd5qeWe9Ct2GEzhrLi4=} Expected: {l:32 b:Uu3AaPzr3p1NNnR6zY6aW6nbeOxBy6AP9XHSLyFUjD8=}
2008-05-27 16:50:11, Info                  CSI    0000015a [SR] Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:20{10}]"tcpmon.ini"; source file in store is also corrupted
2008-05-27 16:50:11, Info                  CSI    0000015b Repair results created

These are the relevant entries I found. Dmex, what do you think about them?

 

[grasshoper]

[FONT=&quot]cbs - Windows Live SkyDrive[/FONT]

 

[dmex]

These are the relevant entries I found. Dmex, what do you think about them?

He isnt the only one getting that SFC error, I found this and heaps of google results for tcpmon.ini all relating to Vista and SFC...

http://www.vistax64.com/vista-general/82936-re-sfc-cannot-fix-all-errors.html

Doesnt explain where his devices from My computer went...

Grasshoper, open services.msc from the start-menu searchbox and look for "Shell Hardware Detection" ... Make sure its has started and has been set to Automatic startup and also make sure the recovery tab has "restart service on failure" set for both first and second failure.

Was the service running because it removes everything from My computer?...It did on XP anyway...


Steven

 

[grasshoper]

i did what you said, and it is set to automatic startup and the recovery tab has "restart service on failure" for first and second failure.

anything else i can try?
thanks heaps for your help!

 

[sidney1st]

Hi,
You must be infected a way or another and this key in registry has surely been modified.
[HCR\CLSID\{EFA24E64-B078-11d0-89E4-00C04FC9E26E}]

Would you post the content of this key?
Make sure to clean your computer before repairing this key.

 

[johngalt]

that key holds this in my computer:

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{EFA24E64-B078-11D0-89E4-00C04FC9E26E}]

[HKEY_CLASSES_ROOT\CLSID\{EFA24E64-B078-11D0-89E4-00C04FC9E26E}\Implemented Categories]

[HKEY_CLASSES_ROOT\CLSID\{EFA24E64-B078-11D0-89E4-00C04FC9E26E}\Implemented Categories\{00021493-0000-0000-C000-000000000046}]

I know you wanted grasshopper to post his as well, Sidney, I am just surprised that it has not values for any of the sub keys....

 

[sidney1st]

Ok, then what do you have in:
HCU\Software\Microsoft\Internet Explorer\Main
The reg file should be better in that case.

Oups, it's grasshopper reg file i need, unless you have the same problem

 

[grasshoper]

Hi,
You must be infected a way or another and this key in registry has surely been modified.
[HCR\CLSID\{EFA24E64-B078-11d0-89E4-00C04FC9E26E}]

Would you post the content of this key?
Make sure to clean your computer before repairing this key.

where is this?

 

[johngalt]

@Grasshopper: HKEY_CLASSES_ROOT\CLSID\{EFA24E64-B078-11D0-89E4-00C04FC9E26E}

HCR is just an abbreviated way of saying HKey_Classes_Root

@sidney - no, I don't have that problem, but still - surprised to see nothing really there....

 

[sidney1st]

@sidney - no, I don't have that problem, but still - surprised to see nothing really there....

This entry was used before Vista, nothing to be seen there normally.
But if some bad entries are added, it could upset explorer a lot.

 

[grasshoper]

@Grasshopper: HKEY_CLASSES_ROOT\CLSID\{EFA24E64-B078-11D0-89E4-00C04FC9E26E}

HCR is just an abbreviated way of saying HKey_Classes_Root

@sidney - no, I don't have that problem, but still - surprised to see nothing really there....

0kay, so in {EFA24E64-B078-11D0-89E4-00C04FC9E26E} there is a folder called "implemented catagories, and in that there is a folder called {00021493-0000-0000-C000-000000000046} do you wan't whats in that?

sorry i'm not very good at this

 

[sidney1st]

Ok, if it is empty please go to thr following key:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Right click on main and export the reg file to your desktop for example.
Attach this file in a post.

 

[grasshoper]

Ok, if it is empty please go to thr following key:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Right click on main and export the reg file to your desktop for example.
Attach this file in a post.

here it is:

 

[johngalt]

I compared the one you uploaded to the one in my registry - you are missing a *lot* of stuff.

Under HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main you have:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
@=""
"Disable Script Debugger"="yes"
"Anchor Underline"="yes"
"Cache_Update_Frequency"="Once_Per_Session"
"Display Inline Images"="yes"
"Do404Search"=hex:01,00,00,00
"Local Page"="C:\\Windows\\system32\\blank.htm"
"Save_Session_History_On_Exit"="no"
"Show_FullURL"="no"
"Show_StatusBar"="yes"
"Show_ToolBar"="yes"
"Show_URLinStatusBar"="yes"
"Show_URLToolBar"="yes"
"Use_DlgBox_Colors"="yes"
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"XMLHTTP"=dword:00000001
"NoUpdateCheck"=dword:00000001
"UseClearType"="no"
"Enable Browser Extensions"="yes"
"Play_Background_Sounds"="yes"
"Play_Animations"="yes"
"Start Page"="http://127.0.0.1:4664/&s=FsjsdK4uCdhLuxRfSMxAoPU9ZRY"
"Window Title"="Internet Explorer provided by Dell"
"CompatibilityFlags"=dword:00000000
"StartPageCache"=dword:00000001
"FullScreen"="no"
"SearchMigrated"=dword:00000000
"Window_Placement"=hex:2c,00,00,00,02,00,00,00,03,00,00,00,ff,ff,ff,ff,ff,ff,\
  ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,1b,00,00,00,00,00,00,00,9b,02,00,00,02,03,00,\
  00
"NotifyDownloadComplete"="yes"
"Use FormSuggest"="yes"
"FormSuggest Passwords"="yes"
"FormSuggest PW Ask"="yes"
"RunOnceComplete"=dword:00000001
"RunOnceHasShown"=dword:00000001
"AlwaysShowMenus"=dword:00000001
"AutoHide"="yes"
"Enable_MyPics_Hoverbar"="no"
"ShowedCheckBrowser"="Yes"
"Check_Associations"="no"

Whereas *I* have

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
@=""
"Disable Script Debugger"="yes"
"Anchor Underline"="yes"
"Cache_Update_Frequency"="Once_Per_Session"
"Display Inline Images"="yes"
"Do404Search"=hex:01,00,00,00
"Local Page"="C:\\Windows\\system32\\blank.htm"
"Save_Session_History_On_Exit"="no"
"Show_FullURL"="no"
"Show_StatusBar"="yes"
"Show_ToolBar"="yes"
"Show_URLinStatusBar"="yes"
"Show_URLToolBar"="yes"
"Use_DlgBox_Colors"="yes"
"Search Page"="http://www.google.com"
"XMLHTTP"=dword:00000001
"NoUpdateCheck"=dword:00000001
"UseClearType"="no"
"Enable Browser Extensions"="yes"
"Play_Background_Sounds"="yes"
"Play_Animations"="yes"
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
"CompatibilityFlags"=dword:00000000
"FullScreen"="no"
"SearchMigrated"=dword:00000000
"Window_Placement"=hex:2c,00,00,00,02,00,00,00,03,00,00,00,ff,ff,ff,ff,ff,ff,\
  ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,60,09,00,00,71,00,00,00,80,0c,00,00,ab,02,00,\
  00
"StartPageCache"=dword:00000001
"RunOnceHasShown"=dword:00000001
"RunOnceComplete"=dword:00000001
"NotifyDownloadComplete"="no"
"Use FormSuggest"="no"
"FormSuggest PW Ask"="no"
"ShowedCheckBrowser"="Yes"
"Check_Associations"="no"
"Expand Alt Text"="no"
"Move System Caret"="no"
"NscSingleExpand"=dword:00000000
"DisableScriptDebuggerIE"="yes"
"Error Dlg Displayed On Every Error"="no"
"Page_Transitions"=dword:00000001
"FavIntelliMenus"="no"
"UseThemes"=dword:00000001
"EnableSearchPane"=dword:00000000
"Force Offscreen Composition"=dword:00000000
"AllowWindowReuse"=dword:00000001
"Friendly http errors"="yes"
"SmoothScroll"=dword:00000001
"Enable AutoImageResize"="yes"
"Show image placeholders"=dword:00000000
"Print_Background"="no"
"AutoSearch"=dword:00000004
"Secondary Start Pages"=hex(7):00,00,00,00,00,00,00,00
"AlwaysShowMenus"=dword:00000000
"Search Bar"="http://www.google.com/ie"
"Default_Search_URL"="http://www.google.com/ie"

Under [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Default Feeds]

You have 3 different CLSIDs than I do, but the data in each one is hte same as mine.

Under [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LocalMachine_Lockdown\Settings] you have nothing,

Whereas I have

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings]
@=""
"LOCALMACHINE_CD_UNLOCK"=dword:00000000

I think whoever said it is right - looks like you might have some sort of Malware that has messed with your IE settings. Best start looking into scanning your system.

@other VPros - you think if I uploaded my registry settings for just that 'Main' section and he imported it it might help? Not sure, and some of my settings are customized....not many, but some....or are hte additional settings I have because I ma using Aero / have Visual themes enabled?

 

[grasshoper]

Okay, wow sounds bad? i have norton.. it doesn't pick up anything. what should i do?

 

[johngalt]

Not sure yet - as I asked the other members here, it is possible that yours is simply not having as many items as mine because of theme difference or something else....

Do you have Aero enabled?

 

[grasshoper]

okay,
yes i have aero enabled.

 

[johngalt]

OK, let one of the other pros see this and give their advice - I'm tempted to just export my copy and send it to you but I am worried that that will make things *worse* not better.....

 

[sidney1st]

Grasshopper,
Run a hijackthis to be sure before finding the problem and attach the log file here.
There is something i do not understand and before going further it is definitely good to know if you are infected or not.

 

[johngalt]

That is what I was thinking too....something is not right in Mudville....